How do we determine IP Address of interface the packet arrived on

How do we determine IP Address of interface the packet arrived on

[Maninder Singh]

Hi,

Each time a packet arrives at a router in a subnet during transit, I
need to determine the IP address of the incoming interface of the
router for that packet. I have a netfilter kernel module running at
each router but I dont understand which data structure will give me
thw IP address. Can someone please suggest how shall I get that?


Thanks
Maninder

How do we determine IP Address of interface the packet arrived on

[Vlad Dogaru]

On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> Hi,
> 
> Each time a packet arrives at a router in a subnet during transit, I
> need to determine the IP address of the incoming interface of the
> router for that packet. I have a netfilter kernel module running at
> each router but I dont understand which data structure will give me
> thw IP address. Can someone please suggest how shall I get that?

An interface can have more than one IP address, so your question is a
little strange.

However, you can find out all the IPv4 addresses a particular device has
by iterating through dev->ip_ptr->ifa_list.

Hope this helps,
Vlad

How do we determine IP Address of interface the packet arrived on

[정현]

And you should be careful about obtained IP address, because it is made by
IP spoofing attack or some sort of IP camo technique.

Hope this helps too,
Hyun
On Sep 24, 2014 4:42 PM, "Vlad Dogaru" <ddvlad@herebedragons.ro> wrote:

> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> > Hi,
> >
> > Each time a packet arrives at a router in a subnet during transit, I
> > need to determine the IP address of the incoming interface of the
> > router for that packet. I have a netfilter kernel module running at
> > each router but I dont understand which data structure will give me
> > thw IP address. Can someone please suggest how shall I get that?
>
> An interface can have more than one IP address, so your question is a
> little strange.
>
> However, you can find out all the IPv4 addresses a particular device has
> by iterating through dev->ip_ptr->ifa_list.
>
> Hope this helps,
> Vlad
>
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20140924/12e024c7/attachment.html 

How do we determine IP Address of interface the packet arrived on

[Valdis.Kletnieks at vt.edu]

On Wed, 24 Sep 2014 21:03:01 +0900, ?????? said:

> And you should be careful about obtained IP address, because it is made by
> IP spoofing attack or some sort of IP camo technique.

He's looking at the IP address of the interface, not the source IP
address of the packet.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20140924/3fe391f5/attachment.bin 

How do we determine IP Address of interface the packet arrived on

[Valdis.Kletnieks at vt.edu]

On Wed, 24 Sep 2014 10:19:34 +0530, Maninder Singh said:
> Hi,
>
> Each time a packet arrives at a router in a subnet during transit, I
> need to determine the IP address of the incoming interface of the
> router for that packet.

What problem are you trying to solve using the IP address of the interface,
given that a single interface can have multiple IP addresses?

(Also - are your writing your code to be IPv6-ready? :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20140924/2f768d0f/attachment-0001.bin 

How do we determine IP Address of interface the packet arrived on

[John de la Garza]

On Wed, Sep 24, 2014 at 10:41:54AM +0300, Vlad Dogaru wrote:
> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> > Hi,
> > 
> > Each time a packet arrives at a router in a subnet during transit, I
> > need to determine the IP address of the incoming interface of the
> > router for that packet. I have a netfilter kernel module running at
> > each router but I dont understand which data structure will give me
> > thw IP address. Can someone please suggest how shall I get that?
> 
> An interface can have more than one IP address, so your question is a
> little strange.
> 

why not look at the destination ip of the ip header?

How do we determine IP Address of interface the packet arrived on

[Valdis.Kletnieks at vt.edu]

On Wed, 24 Sep 2014 10:08:29 -0400, John de la Garza said:

> why not look at the destination ip of the ip header?

It's possible to receive a packet on the "wrong" interface.

For instance, we have a software package installed here that
insists on talking on one IP address, so we end up with this
setup:

world - 198.82.X.Y- |BOX| - 172.28.40.z - private 10G net - clientbox

and the client box does a 'route add host 198.82.x.y gw 172.28.40.z', so
when it sends packets to 198.82.x.y, it shows up on the box's 10G interface.
Said packet is then cheerfully accepted, because the destination address
matches *one* of the boxes's addresses (just on a different interface).

Another similar situation is for HA, where you'll have a pair (or more) of
boxes that each have their own IP address on a subnet, and a floating IP that's
used by client machines to actually access the service, and which moves back
and forth if a box fails or is down for maintenance. So the active one of the
HA pair has 2 addresses on the interface.

And that's not even starting on the case of "Linux-based router", where
*most* packets you handle don't have your IP address in the destination
field, because you are going to forward it.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 848 bytes
Desc: not available
Url : http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20140924/b702dc34/attachment.bin 

How do we determine IP Address of interface the packet arrived on

[Jeff Haran]

> -----Original Message-----
> From: kernelnewbies-bounces at kernelnewbies.org [mailto:kernelnewbies-
> bounces at kernelnewbies.org] On Behalf Of Vlad Dogaru
> Sent: Wednesday, September 24, 2014 12:42 AM
> To: Maninder Singh
> Cc: kernelnewbies at kernelnewbies.org
> Subject: Re: How do we determine IP Address of interface the packet arrived on
> 
> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
> > Hi,
> >
> > Each time a packet arrives at a router in a subnet during transit, I
> > need to determine the IP address of the incoming interface of the
> > router for that packet. I have a netfilter kernel module running at
> > each router but I dont understand which data structure will give me
> > thw IP address. Can someone please suggest how shall I get that?
> 
> An interface can have more than one IP address, so your question is a little
> strange.
> 
> However, you can find out all the IPv4 addresses a particular device has by
> iterating through dev->ip_ptr->ifa_list.
> 
> Hope this helps,
> Vlad

If what you are trying to determine is whether the incoming packet is destined to the router this code is running on, one option would be to do a route lookup on the destination address in the packet via a call to inet_addr_type(). If it returns RTN_LOCAL, then it will get routed locally. That might be easier that walking the ifa_list. It should also cover the case where the DA is an IP address assigned to another interface on the router that happened to get routed to a different subnet and thus got received on the "wrong" interface.

Of course, things like ip rules and alternative routing tables can make all this much more complicated.

Whether this works for you or not will depends what you are trying to accomplish here,

Jeff Haran

How do we determine IP Address of interface the packet arrived on

[maninder.tiet at gmail.com]

Hi.. Thanks for your reply. I agree that an interface can have more than one ipv6 addresses but in the PoC I am doing for an IP Traceback technique, I need to record a hash of the IP of incoming interface. For that I need to be able to read the packet.

Your reply gave me a direction to explore the use of dev->ip6_ptr->ac_list .. For ipv6.  However I m not sure what is ac_list and what is mc_list here.. I wonder if there is some documentation around it in this world. Can you please give me a pointer or if you could brief me about how do I list all ipv6 addresses of the interface.

Well, yet I tried to get the ip addresses pointed to by ac_list and before I could see if it displays something, system slows down unbelievably with syllogism error as 'takedown serio0. Some program might be trying to access hardware directly." And mouse stops moving. I am not sure if this error is a result of my operation or something else. I will try loading this module Again. But any comments from  your side on this please?



Thanks
Maninder


> On 24-Sep-2014, at 1:11 pm, Vlad Dogaru <ddvlad@herebedragons.ro> wrote:
> 
>> On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote:
>> Hi,
>> 
>> Each time a packet arrives at a router in a subnet during transit, I
>> need to determine the IP address of the incoming interface of the
>> router for that packet. I have a netfilter kernel module running at
>> each router but I dont understand which data structure will give me
>> thw IP address. Can someone please suggest how shall I get that?
> 
> An interface can have more than one IP address, so your question is a
> little strange.
> 
> However, you can find out all the IPv4 addresses a particular device has
> by iterating through dev->ip_ptr->ifa_list.
> 
> Hope this helps,
> Vlad

How do we determine IP Address of interface the packet arrived on

[Maninder Singh]

Hi Valdis,

I am trying some PoC for an IP traceback method in IPv6. For that, I
need to record a variant (like a hash) of the IP address of the
interface where packet arrives in a router.


Thanks
Maninder

On Wed, Sep 24, 2014 at 5:55 PM,  <Valdis.Kletnieks@vt.edu> wrote:
> On Wed, 24 Sep 2014 10:19:34 +0530, Maninder Singh said:
>> Hi,
>>
>> Each time a packet arrives at a router in a subnet during transit, I
>> need to determine the IP address of the incoming interface of the
>> router for that packet.
>
> What problem are you trying to solve using the IP address of the interface,
> given that a single interface can have multiple IP addresses?
>
> (Also - are your writing your code to be IPv6-ready? :)