1

I do need a log of packets which are dropped by rp_filter ... how to do this logging ?

which logs how to enable.

0

As far as I know those are not logged. Unless somebody else proves me wrong, here's an alternate method.

What you can do instead is steps 1+2 or 1+3 below:

  1. disable rp_filter completely.

  2. use iptables' rpfilter match module, once with the LOG target for simple log, or NFLOG (or even NFQUEUE though that's not the intended usage) for full packet dump, and once with the DROP target to actually filter.

    Using NFLOG correctly would probably require a separate question on its own, but I can tell that even without a specialized tool, tcpdump can listen to a nflog netlink socket as if it was an interface. Usually done first with:

    # tcpdump -D
    

    to retrieve the correct interface index. Eg:

    [...]

    12.nflog (Linux netfilter log (NFLOG) interface)
    13.nfqueue (Linux netfilter queue (NFQUEUE) interface)
    

    [...]

    # tcpdump -n -i 12
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on nflog, link-type NFLOG (Linux netfilter log messages), capture size 262144 bytes
    

    You could choose to write them to a file too (-w dump.cap)

  3. or use nft's fib match for an equivalent method using (recent enough) nftables instead of iptables, with some equivalent log method.

Using netfilter's firewalling layer is the only method for IPv6 which lacks direct support for rp_filter in its routing stack on Linux.

Some corner cases related to ARP or policy routing might not behave 100% identically because the filtering is probably done later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.