On Wed, 24 Sep 2014 21:03:01 +0900, 정현 said:

And you should be careful about obtained IP address, because it is made by IP spoofing attack or some sort of IP camo technique.

He's looking at the IP address of the interface, not the source IP address of the packet.

On Wed, 24 Sep 2014 10:08:29 -0400, John de la Garza said:

why not look at the destination ip of the ip header?

It's possible to receive a packet on the "wrong" interface. For instance, we have a software package installed here that insists on talking on one IP address, so we end up with this setup: world - 198.82.X.Y- |BOX| - 172.28.40.z - private 10G net - clientbox and the client box does a 'route add host 198.82.x.y gw 172.28.40.z', so when it sends packets to 198.82.x.y, it shows up on the box's 10G interface. Said packet is then cheerfully accepted, because the destination address matches *one* of the boxes's addresses (just on a different interface). Another similar situation is for HA, where you'll have a pair (or more) of boxes that each have their own IP address on a subnet, and a floating IP that's used by client machines to actually access the service, and which moves back and forth if a box fails or is down for maintenance. So the active one of the HA pair has 2 addresses on the interface. And that's not even starting on the case of "Linux-based router", where *most* packets you handle don't have your IP address in the destination field, because you are going to forward it.

Hi.. Thanks for your reply. I agree that an interface can have more than one ipv6 addresses but in the PoC I am doing for an IP Traceback technique, I need to record a hash of the IP of incoming interface. For that I need to be able to read the packet. Your reply gave me a direction to explore the use of dev->ip6_ptr->ac_list .. For ipv6. However I m not sure what is ac_list and what is mc_list here.. I wonder if there is some documentation around it in this world. Can you please give me a pointer or if you could brief me about how do I list all ipv6 addresses of the interface. Well, yet I tried to get the ip addresses pointed to by ac_list and before I could see if it displays something, system slows down unbelievably with syllogism error as 'takedown serio0. Some program might be trying to access hardware directly." And mouse stops moving. I am not sure if this error is a result of my operation or something else. I will try loading this module Again. But any comments from your side on this please? Thanks Maninder

On 24-Sep-2014, at 1:11 pm, Vlad Dogaru <ddvlad@herebedragons.ro> wrote:

...

On Wed, Sep 24, 2014 at 10:19:34AM +0530, Maninder Singh wrote: Hi,

Each time a packet arrives at a router in a subnet during transit, I need to determine the IP address of the incoming interface of the router for that packet. I have a netfilter kernel module running at each router but I dont understand which data structure will give me thw IP address. Can someone please suggest how shall I get that?

An interface can have more than one IP address, so your question is a little strange.

However, you can find out all the IPv4 addresses a particular device has by iterating through dev->ip_ptr->ifa_list.

Hope this helps, Vlad

Hi Valdis, I am trying some PoC for an IP traceback method in IPv6. For that, I need to record a variant (like a hash) of the IP address of the interface where packet arrives in a router. Thanks Maninder On Wed, Sep 24, 2014 at 5:55 PM, <Valdis.Kletnieks@vt.edu> wrote:

On Wed, 24 Sep 2014 10:19:34 +0530, Maninder Singh said:

...

Hi,

Each time a packet arrives at a router in a subnet during transit, I need to determine the IP address of the incoming interface of the router for that packet.

What problem are you trying to solve using the IP address of the interface, given that a single interface can have multiple IP addresses?

(Also - are your writing your code to be IPv6-ready? :)