0

Here is the thing, I used tcpdump and created a UDP-only pcap file from production environment.

Then with the tool tcprewrite, I updated the UDP packets dst IP and MAC address as vm2, src IP as vm1 but src MAC as 00:00:00:00:00:00. And I re-calculate the checksum.

Then I tcpreplay the crafted pcap file from vm1, then examined the tcpdump on vm2, I saw vm2 actually get the UDP packet but the src MAC was updated to network gateway's.

P.S I use gcloud, the vm1 and vm2 are in the same subnet.

|-----|            |-----|
| vm1 | ---|gw|----| vm2 |
|-----|            |-----|

Then I ran tcpdump on vm1, and I saw the UDP packet was sent as MAC address 00:00:00:00:00:00, so the router(gateway) accepted it(although it is "wrong") and updated the MAC and forwarded to vm2.

so it turns out to me that the MAC address does not matter as long as the IP address and packet checksum is good, otherwise why not the router drop it?

1
  • I think this question would be much better worded as "what is the source mac address on a packet used for". Jun 27, 2022 at 11:20

1 Answer 1

1

Did I understand correctly that the vm1-gw connection has a different IP network than vm2-gw?

If so, then the gw works like an L3 router. The MAC address is a value bound only to the 2nd layer and is always lost when the packet passes through the router. Changing the MAC address you describe is normal behavior. The router has a different broadcast domain on each of the two interfaces. The MAC addresses remain unchanged only inside the broadcast domain, where the L2 layer values, i.e. MAC addresses (except ARP) are sufficient for communication. The ARP protocol will help nodes in the broadcast domain to find out each other's MAC addresses using their IP addresses, and then the connection between the nodes takes place only by MAC.

If you want to use the gw as a firewall to filter connections between different IP networks, you need to work with IP addresses, not MAC.

If your intention is otherwise, please clarify the question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .