bpf does not see packets forwarded with ipfw fwd

[Robert Watson]

On Sat, 12 Apr 2008, Eugene Grosbein wrote:

> One of 7.0 users has reported in some cyrillic newsgroup a problem that I 
> have reproduced in my 7.0-STABLE system. That is: tcpdump does not show 
> locally originated outgoing IP packets that were processed by 'ipfw fwd' 
> rule. The same configuration presents no problems with 6.3-STABLE.
>
> Consider simple schema: two FreeBSD boxes (A and B) directly connected with 
> ethernet intefaces. The box A has another ethernet interface and uses "ipfw 
> fwd" as its very first ipfw rule to forward some packets to B, while these 
> packets would normally go out trough mentioned another interface. Now, 
> tcpdump does NOT show outgoing packets but host B also runs tcpdump on its 
> incoming interface and does see them.
>
> I double-checked all paramerets for tcpdump, all routing tables. I even 
> connected A and B with cross-over ethernet cable, without a switch. Still, B 
> sees incoming packets coming over the cable and A does not see them leaving. 
> This bothers me a bit :-)

If you ping from host A to host B, does tcpdump see both the ICMP echo request 
and reply on both boxes?  In principle, ipfw fwd uses the same output paths as 
the rest of the IP stack, so it would be useful to know whether it sees other 
outbound traffic properly or not.

Robert N M Watson
Computer Laboratory
University of Cambridge