0

For a outgoing packet, by route I can know which interface is using, but for a incoming packet, how to find out which interface is using?

1
  • Well, you know which IPs are bound to each interface, right?
    – EEAA
    Mar 16, 2017 at 1:17

3 Answers 3

1

You're looking for the ip route get command. This is the equivalent of the BSD route get.

ip route get 50.232.186.20 for example will display what route will be used to get to that IP. This command does not resolve host names on its own.

4
  • 50.232.186.20 via 10.0.2.1 dev eth0 src 10.0.2.191, what does this mean?
    – Sato
    Mar 16, 2017 at 1:28
  • Well, that's the route it took. It got to 50.232.186.20 (destination address) via 10.0.2.1 (the gateway) on device eth0 (answering your question) from the source 10.0.2.191 (which is of course on eth0).
    – Spooler
    Mar 16, 2017 at 1:30
  • But how to know which interface will be used when a packet comes in? For example for a packet from 50.232.186.20 to 10.0.2.191, which will be used? and for a packet from 10.0.2.190 to 10.0.2.191, which will be used? Its same with the outgoing packet?
    – Sato
    Mar 16, 2017 at 1:37
  • In that case, you're communicating with <something> to 10.0.2.191, which is bound to eth0.
    – Spooler
    Mar 16, 2017 at 1:40
0

In general, Linux expects a packet to enter through the same interface as it would exit.

When that is not the case, the kernel reports a packet as a martian, and if you have the following sysctl value set, packets will be dropped if they are seen from an interface which cannot route back to the (the rp in rp_filter standard for Reverse Path).

net.ipv4.conf.all.rp_filter = 1

So normally, unless you have a particularly complicated routing table or setup, you can check the output of ip r and make an educated guess. Most likely, you will want to check what your default route is, and there will be a strong chance that the answer to your question will be "whatever interface your default route is pointing to".

All of the above can be changed by the admins if necessary, but in general, AFAIK this is how most systems work.

0

the packet will come from its ip address interface ( destination address) otherwise it will not reach the interface and the packet is ignored ( like in a hub) if the packet is a broadcast then it will come from all the interfaces connected to that broadcast domain ( one of the reason why only one ip should be in the same ip subnet)

same goes at MAC level

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .