I want to use the Linux Traffic Controller (tc) to mirror ICMP traffic from the Wireguard port (zt0) to the loopback interface lo. The tc configuration is as follows:
r1:~# tc qdisc show ingress
qdisc ingress ffff: dev zt0 parent ffff:fff1 ----------------
r1:~# tc filter show dev zt0 parent ffff:
filter protocol ip pref 49152 u32 chain 0
filter protocol ip pref 49152 u32 chain 0 fh 800: ht divisor 1
filter protocol ip pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid not_in_hw
match 00010000/00ff0000 at 8
action order 1: mirred (Egress Mirror to device lo) pipe
index 1 ref 1 bind 1
I used the tcpdump tool to check the inbound data as follows:
r1:~# tcpdump -i lo -vvv -n
tcpdump: listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:21:22.235948 40:00:40:01:3a:35 > 45:00:00:54:c4:49, ethertype Unknown (0x0a14), length 84:
0x0000: 1402 0a14 1401 0800 bd24 7c36 0001 72d6 .........$|6..r.
0x0010: 3966 0000 0000 4e94 0500 0000 0000 1011 9f....N.........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
15:21:23.234824 40:00:40:01:39:8d > 45:00:00:54:c4:f1, ethertype Unknown (0x0a14), length 84:
0x0000: 1402 0a14 1401 0800 921e 7c36 0002 73d6 ..........|6..s.
0x0010: 3966 0000 0000 7899 0500 0000 0000 1011 9f....x.........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
My question is, why can I see normal ICMP data when I capture packets directly on the zt0 port, but when I capture packets on the lo port, it turns into strange data, which seems like the original Wireguard packets? How can I solve this problem?
I tried to capture packets directly on the zt0 port and the data is normal
New contributor
TwitchGG is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.