纳入 Linux 数据包处理堆栈
我们有时必须调试有故障的 Cisco 路由器，这些路由器无法正确处理 TCP 选择性确认 (SACK) 选项。这会导致我们的 TCP 会话在通过 IPTABLES 端口重定向规则路由时终止。
为了帮助诊断，我一直在构建一个基于 python 的实用程序来构建一系列可以随意重现此错误的数据包，该实现使用原始套接字来执行此技巧。我的 ICMP ping 运行良好，但在 UDP 实现上遇到了障碍，我可以毫无问题地构造、发送和接收数据包，我看到的问题是 Linux 不喜欢 UDP数据包从远程系统发回，并且始终发送 ICMP 目标无法到达的数据包，即使我的 python 脚本能够接收和处理数据包而没有任何明显问题。
我的问题：在使用 RAW 套接字时，是否可以包含 Linux UDP 堆栈来绕过这些 ICMP 错误消息？
谢谢
We occasionally have to debug glitchy Cisco routers that don't handle the TCP Selective Acknowledgment (SACK) options correctly. This causes our TCP sessions to die when routed through an IPTABLES port redirection rule.
To help with the diagnosis, I've been constructing a python-based utility to construct a sequence of packets that can reproduce this error at will, the implementation uses raw sockets to perform this trick. I've got an ICMP ping working nicely but I've run into a snag on the UDP implementation, I can construct, send and receive the packet without problem, the issue that I'm seeing is that Linux doesn't like the UDP packets being sent back from the remote system and always sends an ICMP Destination unreachable packet, even though my python script is able to receive and process the packet without any apparent problems.
My question: Is it possible to subsume the Linux UDP stack to bypass these ICMP error messages when working with RAW sockets?.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否正在接收并处理该数据包，只需要抑制ICMP端口不可达？如果是这样，也许只需在 iptables OUTPUT 链中添加一个条目即可删除它？
Are you receiving and processing the packet and only need to suppress the ICMP port-unreachable? If so, maybe just add an entry to the iptables OUTPUT chain to drop it?