Why are ICMP packets not captured on the target interface?

Question

I have a network setup as in the picture:

The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet.

• gateway: I can ping all interfaces and hosts on Internet
• laptop: I can ping all interfaces and hosts on Internet except 192.168.0.254

_{I do not know yet why I cannot ping it, and this is why I am capturing the traffic. This is not my question, though if someone has an idea it is welcome. All interfaces accept all traffic and there is forwarding in place between all interfaces}

When capturing packets to understand why the ping fails, I did three tests

1. ping from laptop to 192.168.0.10

The ping goes through, but tcpdump -i int0 icmp does not show any packets captured

2. ping from laptop to 192.168.0.254

The ping does not go through and tcpdump -i int0 icmp shows

13:26:28.032635 IP 10.10.10.93 > 192.168.0.254: ICMP echo request, id 1, seq 671, length 40
13:26:32.604606 IP 10.10.10.93 > 192.168.0.254: ICMP echo request, id 1, seq 672, length 40

3. ping from laptop to 8.8.8.8

The ping goes through and tcpdump -i int0 icmp shows

14:02:52.016081 IP 192.168.0.10 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 749, length 40
14:02:52.029388 IP google-public-dns-a.google.com > 192.168.0.10: ICMP echo reply, id 1, seq 749, length 40

I understand the second case (at least the fact that the echo request is captured).

Why in the first case no packets are captured while the ping goes through?

Why in the third case the capture only shows a request from 192.168.0.10? Where is the one from laptop? (I guess that the reason is the same as above)

Answer 1

Why in the first case no packets are captured while the ping goes through?

Because you're capturing on int0 but the packet doesn't get sent on int0. The laptop sends it to the gateway over lan0, and the gateway says "192.168.0.10 - hey, that's me!" and sends a response back on lan0. It doesn't need to forward the packet to another host on the 192.168.0 network, and therefore doesn't need to send it out on int0.

yes, int0 masquerades traffic from lan0 to internet. There is also DNAT to redirect a port on 192.168.0.10 to an internal host.

Then that might explain "Why in the third case the capture only shows a request from 192.168.0.10?" - the request from the laptop may have had its source IP address modified to be 192.168.0.10 before being sent on int0.