[ILUG] routing woes

Thu Aug 25 23:48:22 IST 2005

>Which device is doing address translation ?
>What are they configured to do address translation for ?

192.168.0.0/16 IIRC

>If the router is doing NAT for 192.168.2.0/24 only those
>machines in that network will route correctly.

this has worked before with that same router and I didn't change the config. All i changed was the linux box in between.

I did a few dumps from the winbox:

this is what it looks like when it fails:

D:\Daten\My Downloads>windump -i \Device\NPF_{A1DC760A-5069-4136-B4CA-E071EB31E3B8} -n -v
windump: listening on \Device\NPF_{A1DC760A-5069-4136-B4CA-E071EB31E3B8}
23:40:06.999157 IP (tos 0x0, ttl 128, id 11368, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.1.90 > 66.102.9.104: IC
MP echo request, id 1024, seq 26880, length 40
23:40:06.999700 IP (tos 0x0, ttl  63, id 14206, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.2.1 > 192.168.1.90: ICM
P redirect 66.102.9.104 to host 87.192.244.1, length 36
        IP (tos 0x0, ttl 126, id 11368, offset 0, flags [none], proto: ICMP (1), length: 60, bad cksum 189 (->289)!) 192.168.1.90 >
66.102.9.104: ICMP echo request, id 1024, seq 26880, length 40
23:40:11.999061 arp who-has 192.168.1.90 tell 192.168.1.100
23:40:11.999085 arp reply 192.168.1.90 is-at 00:50:2c:02:90:7c
23:40:12.495675 IP (tos 0x0, ttl 128, id 11371, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.1.90 > 66.102.9.104: IC
MP echo request, id 1024, seq 27136, length 40
23:40:12.496175 IP (tos 0x0, ttl  63, id 14462, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.2.1 > 192.168.1.90: ICM
P redirect 66.102.9.104 to host 87.192.244.1, length 36
        IP (tos 0x0, ttl 126, id 11371, offset 0, flags [none], proto: ICMP (1), length: 60, bad cksum 186 (->286)!) 192.168.1.90 >
66.102.9.104: ICMP echo request, id 1024, seq 27136, length 40
23:40:41.278669 IP (tos 0x0, ttl 128, id 11382, offset 0, flags [none], proto: UDP (17), length: 73) 192.168.1.90.1245 > 192.168.2.1
00.53:  54159+ A? forecastfox.accuweather.com. (45)
23:40:41.376038 IP (tos 0x0, ttl  64, id 380, offset 0, flags [DF], proto: UDP (17), length: 327) 192.168.2.100.53 > 192.168.1.90.12
45:  54159 2/8/0 forecastfox.accuweather.com.[|domain]
23:40:41.377757 IP (tos 0x0, ttl 128, id 11385, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.1.90.1364 > 12.130.50.206.
80: S, cksum 0xa062 (correct), 1681422222:1681422222(0) win 65535 <mss 1460,nop,nop,sackOK>
23:40:41.378274 IP (tos 0x0, ttl  63, id 14718, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.2.1 > 192.168.1.90: ICM
P redirect 12.130.50.206 to host 87.192.244.1, length 36
        IP (tos 0x0, ttl 126, id 11385, offset 0, flags [DF], proto: TCP (6), length: 48, bad cksum cdfc (->cefc)!) 192.168.1.90.136
4 > 12.130.50.206.80:  tcp 28 [bad hdr length 0 - too short, < 20]
23:40:44.357219 IP (tos 0x0, ttl 128, id 11386, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.1.90.1364 > 12.130.50.206.
80: S, cksum 0xa062 (correct), 1681422222:1681422222(0) win 65535 <mss 1460,nop,nop,sackOK>
23:40:44.357720 IP (tos 0x0, ttl  63, id 14974, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.2.1 > 192.168.1.90: ICM
P redirect 12.130.50.206 to host 87.192.244.1, length 36
        IP (tos 0x0, ttl 126, id 11386, offset 0, flags [DF], proto: TCP (6), length: 48, bad cksum cdfb (->cefb)!) 192.168.1.90.136
4 > 12.130.50.206.80:  tcp 28 [bad hdr length 0 - too short, < 20]
23:40:50.276091 IP (tos 0x0, ttl 128, id 11387, offset 0, flags [DF], proto: TCP (6), length: 48) 192.168.1.90.1364 > 12.130.50.206.
80: S, cksum 0xa062 (correct), 1681422222:1681422222(0) win 65535 <mss 1460,nop,nop,sackOK>
23:40:50.276627 IP (tos 0x0, ttl  63, id 15230, offset 0, flags [none], proto: ICMP (1), length: 56) 192.168.2.1 > 192.168.1.90: ICM
P redirect 12.130.50.206 to host 87.192.244.1, length 36
        IP (tos 0x0, ttl 126, id 11387, offset 0, flags [DF], proto: TCP (6), length: 48, bad cksum cdfa (->cefa)!) 192.168.1.90.136
4 > 12.130.50.206.80:  tcp 28 [bad hdr length 0 - too short, < 20]
23:40:55.276667 arp who-has 192.168.1.90 tell 192.168.1.100

and this is what it looks like when it works:

23:43:56.737755 arp who-has 192.168.2.100 tell 192.168.2.90
23:43:56.737946 arp reply 192.168.2.100 is-at 00:e0:4c:b5:53:26
23:43:56.737954 IP (tos 0x0, ttl 128, id 11505, offset 0, flags [none], proto: UDP (17), length: 60) 192.168.2.90.1245 > 192.168.2.1
00.53:  57996+ A? www.google.com. (32)
23:43:56.877034 IP (tos 0x0, ttl  64, id 382, offset 0, flags [DF], proto: UDP (17), length: 208) 192.168.2.100.53 > 192.168.2.90.12
45:  57996 4/5/0 www.google.com. CNAME www.l.google.com., www.l.google.com.[|domain]
23:43:56.880054 arp who-has 192.168.2.1 tell 192.168.2.90
23:43:56.880355 arp reply 192.168.2.1 is-at 00:04:e2:e0:c8:7d
23:43:56.880363 IP (tos 0x0, ttl 128, id 11506, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.2.90 > 66.102.9.104: IC
MP echo request, id 1024, seq 27392, length 40
23:43:56.920090 IP (tos 0x0, ttl 241, id 11506, offset 0, flags [none], proto: ICMP (1), length: 60) 66.102.9.104 > 192.168.2.90: IC
MP echo reply, id 1024, seq 27392, length 40
23:43:56.933679 IP (tos 0x0, ttl 128, id 11507, offset 0, flags [none], proto: UDP (17), length: 207) 192.168.2.90.138 > 192.168.2.2
55.138: UDP, length 179
23:43:57.880729 IP (tos 0x0, ttl 128, id 11508, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.2.90 > 66.102.9.104: IC
MP echo request, id 1024, seq 27648, length 40
23:43:57.919833 IP (tos 0x0, ttl 241, id 11508, offset 0, flags [none], proto: ICMP (1), length: 60) 66.102.9.104 > 192.168.2.90: IC
MP echo reply, id 1024, seq 27648, length 40
23:43:58.434482 IP (tos 0x0, ttl 128, id 11509, offset 0, flags [none], proto: UDP (17), length: 207) 192.168.2.90.138 > 192.168.2.2
55.138: UDP, length 179
23:43:58.880927 IP (tos 0x0, ttl 128, id 11510, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.2.90 > 66.102.9.104: IC
MP echo request, id 1024, seq 27904, length 40
23:43:58.968167 IP (tos 0x0, ttl 241, id 11510, offset 0, flags [none], proto: ICMP (1), length: 60) 66.102.9.104 > 192.168.2.90: IC
MP echo reply, id 1024, seq 27904, length 40
23:43:59.882112 IP (tos 0x0, ttl 128, id 11511, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.2.90 > 66.102.9.104: IC
MP echo request, id 1024, seq 28160, length 40
23:43:59.925404 IP (tos 0x0, ttl 241, id 11511, offset 0, flags [none], proto: ICMP (1), length: 60) 66.102.9.104 > 192.168.2.90: IC
MP echo reply, id 1024, seq 28160, length 40

there is definitely something going wrong, but I dunno enough networkig to figure that one :(

cheers

Bernhard

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information.  If you have received it in error, please notify the sender immediately and delete the original.  Any other use of the email by you is prohibited.