Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!aioe.org!feeder.news-service.com!newsfeed.xs4all.nl!newsfeed5.news.xs4all.nl!newsgate.cistron.nl!newsgate.news.xs4all.nl!194.109.133.85.MISMATCH!newsfeed.xs4all.nl!newsfeed6.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Return-Path: <modelnine@modelnine.org>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.004
X-Spam-Evidence: '*H*': 0.99; '*S*': 0.00; '(at': 0.03; '(i.e.,': 0.03; 'python': 0.07; 'pitch': 0.09; 'subject:Problem': 0.09; 'tcp/ip': 0.09; 'linux': 0.11; 'capturing': 0.16; 'matched': 0.16; 'packet': 0.16; 'received:10.2': 0.16; 'response)': 0.16; 'sees': 0.16; 'too)': 0.16; 'stack': 0.16; 'interface': 0.20; 'seems': 0.21; 'header:In-Reply-To:1': 0.22; 'filter': 0.22; 'linux,': 0.22; 'guess': 0.26; 'problem': 0.29; 'mode': 0.29; 'interface.': 0.29; '(the': 0.30; 'least': 0.30; 'yet': 0.30; "won't": 0.30; '---': 0.31; 'feature,': 0.31; 'filtering': 0.31; 'mirror': 0.31; 'called': 0.32; 'to:addr:python-list': 0.32; 'source': 0.32; 'done': 0.32; 'idea': 0.32; 'relatively': 0.33; 'using': 0.34; 'header:User-Agent:1': 0.35; 'some': 0.37; 'machine': 0.37; 'either': 0.37; 'but': 0.38; 'received:org': 0.38; 'under': 0.39; 'to:addr:python.org': 0.39; 'add': 0.39; 'similar': 0.40; "it's": 0.40; 'address': 0.61; 'here': 0.65; 'receive': 0.68; 'destination': 0.68; 'anytime': 0.77; 'schrieb': 0.84; 'sniffer': 0.84
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=modelnine.org; s=modelnine1012; t=1303281928; bh=tGCefwvMmHLfQ1/1sS3jXFNVEWVBff4GX3zoQ9znRK8=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=eKiQrp7JrP5zmxubD76L27eNzodwAkjmewhyfP/iwaXi30dwi9aMMXdflXaseZgcb CS8R/dWtYsoSd2IXRgKVZVAAYBChJ9yoE4UrMKDVfA8R9rCJFJh8fQxxnkG40jUL+N a9Y8xX6G6lJr6b0cefBegiZKcemKbQ22qY1YEBBI=
Date: Wed, 20 Apr 2011 08:45:26 +0200
From: Heiko Wundram <modelnine@modelnine.org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.15) Gecko/20110303 Thunderbird/3.1.9
MIME-Version: 1.0
To: python-list@python.org
Subject: Re: Problem receiving UDP broadcast packets.
References: <iol1tv$8dn$1@reader1.panix.com>	<4dae172e$0$65870$e4fe514c@news.xs4all.nl>	<iol5dm$rdb$2@reader1.panix.com>	<4dae1d82$0$81483$e4fe514c@news.xs4all.nl> <iol7bu$ah2$1@reader1.panix.com>
In-Reply-To: <iol7bu$ah2$1@reader1.panix.com>
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <http://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <http://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.620.1303282060.9059.python-list@python.org>
Lines: 30
NNTP-Posting-Host: 82.94.164.166
X-Trace: 1303282061 news.xs4all.nl 41113 [::ffff:82.94.164.166]:40077
X-Complaints-To: abuse@xs4all.nl
Xref: x330-a1.tempe.blueboxinc.net comp.lang.python:3658

Am 20.04.2011 01:54, schrieb Grant Edwards:
> I guess the problem is that I expected to receive a packet on an
> interface anytime a packet was received with a destination IP address
> that matched that of the the interface.  Apprently there's some
> filtering in the network stack based on the _source_ address as well
> (that seems very counter-intuitive to me).

Just to pitch in here (because nobody's mentioned it yet AFAICT): yes,
there's a filtering done (at least under Linux, and I'd guess something
similar on xBSD too) to packets based on the source address coming in on
an interface, and it's called the reverse path filter and is on by
default (the tunable on Linux is /proc/sys/net/ipv4/conf/*/rp_filter).

The idea behind the reverse path filter is that your machine won't
accept packets coming in over an interface when a return packet (i.e.,
the presumed response) won't be routed over the same interface, and from
what I gather, this is what makes the TCP/IP stack drop the packets
because your machine will not route packets to 192.168.x.x over the same
interface it sees the packet coming in. This is a _security_ feature,
because it makes address spoofing harder.

If you need to see the packets regardless, either use a promiscuous mode
sniffer (i.e., tcpdump, but that's relatively easy to mirror in Python
using SOCK_RAW, capturing packets at the ethernet level), or add a route
on your system for the 192.168.x.x network on the same interface.

HTH!

-- 
--- Heiko.