1

This is a followup to this question I saw on SuperUser, to which no answer has been provided.

A user deleted the second route in his routing table,

# ip route show
  default via 192.168.73.1 dev eth0  proto static 
  192.168.73.0/24 dev eth0  scope link 

leaving only his default. He found out he could ping other pcs on the network, but they could not ping back the pc with the incomplete routing table.

I investigated this on a real network (as opposed to the original, virtual setting) by means of tcpdump: it turns out that the incomplete pc does send back a reply to the ping, but this does not reach the originating, wholesome pc.

So I tried opening an ssh session, on both directions, and now both attempts fail. This is Wireshark's capture of the failed connection:

The presence of the PUSH (PSH/ACK) and the large number of retransmissions make it clear either pc is unable to reach the other one.

Can anyone explain why, in some detail?

2 Answers 2

0

I suppose you forgotten the back route on the other site. The pc in the other side needs to set a proper gateway in order to reach the network , instead use the default gw.

5
  • I am not sure I understand your reply. The other side (the normal one) has both a default gateway and the local route correctly configured. The two pcs are in the same LAN. Nov 17, 2015 at 14:34
  • Sorry , you are right Marius, ip route at the top confuse me but in the screenshot I saw so that you are in the same segment on the same switch the ip address are 71 and 74 did you try to put the nic in 1GB full duplex and removing autonegotiation... on Layer2 we have just some few staffs to play.. Nov 17, 2015 at 14:43
  • Without the possibility to test it right now, i'll try guessing. Missing the route on eth0's subnet means that everything should go through the default gateway. Actually i tried on my machine, the packets from my machine (which is missing the route for the local subnet) go with the IP which Im pinging, but with the arp address of the gateway. Check the arp addresses in wireshark, i think this explains that behaviour. Or retry your test after flushing your arp tables
    – Fredi
    Nov 17, 2015 at 18:11
  • it's not clear for me ....If you are in the same segment of your lan you are on L2 and you'll never get involved the gateway in order talk with each one pc in your lan so your pc makes an arp request and the switch make the rest, that's it.that's the best I can do Nov 17, 2015 at 18:16
  • @FrancescoP started to write a comment but was too long so i put it as an work in progress answer.@MariusMatutiae, can you confirm this? Just check the arp addresses and compare them with the right IP's, or upload a tcpdump -e -s0 of the traffic.
    – Fredi
    Nov 17, 2015 at 21:54
0

[@moderators ecc, this was getting too long in comments so I'll bet on my answer. I'll update this]

Without the possibility to test it fully right now, i'll try guessing. Missing the route on eth0's subnet means that everything should go through the default gateway.

Actually i tried on my machine from where i can only ping another host and the gateway in the same subnet but what i see seems to be in line with what i was guessing.

The packets from my machine (which is missing the route for the local subnet) go with the IP which I'm pinging, but with the arp address of the gateway. Check on your sniff the arp addresses in wireshark so we can have more data.

And do a clean test, after flushing your ARP cache and post here both your findings.

What i think is happening is, the route on the (nosubnet) client's IP is needed for the network stack to know where to "arp" freely as it's reacheble without gateways.

Pulling that out, the only route possible is the default GW and i suppose there is only one network interface on that (no subnet) machine.

Now, considering you're throwing arp packets to the gateway means sending at it's arp address packets meant for a client with another IP (the target) in that same subnet.

The GW forwards them at ARP address of the target, the target having the local route correctly configured replies to the sending host (the one without the subnet).

Assymetric routing in short.

The first host, the sender without the correct local subnet route, sees that as a malformed packet (Alien) as it sent it to the gateway's ARP address.

[/me hopping no networking guy will hit me with a big stick for my eventual errors]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .