Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some simulator software running on linux (linux_host) in which is another linux (linux_sim) is running. The simulator uses libpcap to access the ethernet to provide network simulation on linux_sim. The network is brought up on linux_host and linux_sim OK. I can reach any host in LAN from linux_sim (it uses dhcp for example to setup IP).

The problem is that packets sent from linux_sim do not reach linux_host, however they travel in the opposite direction OK. The latter I can prove with wireshark running on linux_host: if I ping linux_sim on linux_host - I see ICMP requests and replies (from linux_sim) which do not reach linux_host, if I ping vice-versa - I see only ICMP requests (from linux_sim).

The following depicts roughly the architecture I have:



linux_host and linux_sim have different MAC addresses, IP's and from LAN look like independent linux hosts.

I tried on three different linux machines with the same result (with Debian,CentOS and Gentoo).

So, what can you recommend to check/tune/configure in this situation? As I suppose an unusual routing/filtering configuration is required for the linux_host in this case.


The broadcast traffic do reach from linux_sim to linux_host since I see that IP address is resolved with ARP (request broadcasts are replied) OK as the ping starts.

share|improve this question
what simulator software are you using? Is this a vm or something else? – Zoredache Aug 17 '11 at 20:34
This is our proprietary simulation sw, but I am sure this problem is not there since I see all correct packets in wireshark on linux host – pmod Aug 17 '11 at 20:43
up vote 1 down vote accepted

I think a great test would be to put linux_host and linux_sim on different subnets. Put a router (another linux box perhaps) on this VLAN and give it two sub-interfaces there with IPs in both subnets and have it be able to route between the boxes. I think you are running into some sort of issue with reverse path detection. Have you already turned that off?

share|improve this answer
Good advice regarding RPF - I've checked - it's switched off already. Could it be due to method of how libpcap communicates with network interface? I mean the send procedure goes into so low that no routing/filtering/etc are not involved at all? – pmod Aug 18 '11 at 9:45
That would be my assumption too, but I think the only way to verify that would probably be some dtrace hooks which I am not very familiar with. But the outcome would be interesting I think. – polynomial Aug 22 '11 at 22:55

You don't have much information about how your networking is configured. If your simulator is accessing the outside world through a bridge interface, you have to consider what the NIC hardware (and it's driver) are doing. For example, on most newer Intel NICs you have to disable GRO to get TCP working with bridged VMs. There are also often problems with NIC hardware offload and IO-SRV. Look through your drivers documentation for notes on bridging.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.