R: Re: R: Re: mtu issue with ipsec tunnel and netfilter snat

DISCUSSION [email protected] 1 participant 1 message Jan 11, 2013

Subsystems (2)

Networking Network drivers

lore

Share & tools

lore

[email protected]

author

2013-01-11 15:34 UTC #0 lore raw

[email protected] wrote

Quoted 13 lines · On Thursday 2013-01-10 17:46, [email protected] wrote:

Quoted 11 lines
Quoted 5 lines · [email protected] wrote:
Quoted 3 lines
But why linux_gw_snat is not sending icmp need to frag packets to 10.148.12.23?
Perhaps because ICMP was blocked erroneously?
well, I don't see the icmp packets because tcpdump 'see' only the incoming ipsec clear packets. Is there a way to see the outgoing clear ipsec packets with tcpdump?

Quoted 7 lines

Not with AF_PACKET sockets (tcpdump uses such), but you could with iptables -j LOG, NFLOG and TRACE they can be made visible. If you need the full packet, you can either patch up LOG to call the kernel hexdump functions, or use NFLOG - I think - to deliver it to any userspace program to do further processing. If all else fails, there is also NFQUEUE with which the packet can also be copied to userspace.

Thanks for the reply.
I have saved the esp packets with tcpdump and then decrypted with wireshark. Indeed, the icmp need to frag packets are being sent by the linux ipsec gateway.

Thanks for support.