How to send a packet to the kernel?

0
votes

I have two interfaces in my Linux system - eth0 and eth1. I have opened a raw socket on eth0 and I am listening on it for incoming packets. When a packet comes from eth0, I forward it to eth1 after changing the ethernet header (specifically destination MAC to eth1's MAC address). The packet should now be accepted by the interface and sent to the kernel for further processing and eventually to the application waiting for it. But for some reason the packet reaches eth1 (as I can see from wireshark) but the application does not receive it (the application is ping and I don't see the ping reply).

How do I send the packet to eth1 such that it is accepted and sent upstream to the kernel?

1
clinuxsocketsnetworkingraw-sockets
If you can observe via wireshark that the echo request is received at eth1, then the kernel is indeed handling it. Like everything else, Wireshark relies on the kernel. If there is an application listening for such packets that nevertheless does not receive them, then your firewall would be my first suspect. - John Bollinger
When you changed the MAC address, did you recalculate and replace the FCS? Also, the stack on the new interface will drop the packet if the the layer-3 address doesn't match on that interface. That requires changing the destination IP address and recalculating the IPv4 header CRC (IPv6 doesn't have a CRC on the IP header). When you change the IP address, then the TCP or UDP pseudo-header changes, and you must change that, too. - Ron Maupin
@JohnBollinger I am using ubuntu and the ufw is inactive. Is there another layer of firewall that I should be checking? - The Prenx
@RonMaupin Since I am using raw sockets I only have to provide the ethernet header. The rest is handled by the low level drivers. Thus I have no control over the FCS when sending packets. Also the L3 is correctly destined to eth1 along with all higher level headers. - The Prenx
@ThePrenx, Ron seems to have a good point that you dismiss too quickly. It is not about whether you can deliver a packet to eth1. You've already satisfied yourself that you can do so. The issue, then, is with what the system does afterward. Even if you are using a raw socket at eth1 to receive packets, that does not necessarily mean that the kernel will not first validate incoming packets according to the protocol they claim to implement, before handing them off to the application layer. - John Bollinger

1 Answers

1
votes

There is probably a misunderstanding here:

If you send a packet through a raw socket on an interface, in your case eth1, it will not be treated as local to the kernel, regardless of its mac-address, but will leave the interface to the network (with its own mac-address as destination). This is what you observe with wireshark.

If you want the packet to be processed by your kernel, send it to the lo-interface (Loopback-interface), which is specifically for that purpose.