Join Log in
Score:1
QF0 avatar Server

'socat' not displaying incoming UDP packets, but Wireshark does

gu flag
QF0

The link is an image of a Wireshark dump of an incoming 60-byte Ethernet frame which contains a UDP packet. The packet payload is the single word 'hello' (sorry, I don't have enough rep to paste the image directly).

Problem: I can't get socat or nc to read and display this packet (this isn't entirely true; see #1 below).

I run the reader as:

$ socat UDP:192.168.50.129:5000 -

I've tried various different UDP-related address formats as well as this one. The writer is run as:

$ socat READLINE UDP:192.168.50.132:5000

Question: how do I display this incoming packet, preferably as the single wordhello?

There are unfortunately some complications:

#1

If I run the reader as # socat INTERFACE:ens4f0 - then I do get a display of the incoming frame (it's displayed twice, for some reason). There's some binary output and then the word hello. However, I can't do this, as there will eventually be other processes using this interface, so I need to understand what's going on

#2

The incoming frame actually has a dst IP address of 192.168.50.132; the firewall is set to convert this to 192.168.50.129, which is the address the reader is listening on:

  # iptables -t nat -A PREROUTING -i ens4f0 -j DNAT --to 192.168.50.129

The Wireshark output shows the incoming packet before this conversion, so shows the dst IP address as 192.168.50.132. I don't really know whether or not this is working - can I get socat to produce a hex dump of what it is actually seeing on ens4f0?

#3

This is the difficult one, but I'm hoping that it's not related. This is actually a loopback test: a single frame goes out on ens4f0, is looped back by external hardware, and is returned unmodified to ens4f0. The NIC has IP address 192.168.50.129. I have an ip neigh add command which routes accesses to 192.168.50.132 out from ens4f0 to the external hardware; the packet is returned unmodified, which is why I need the iptables command to convert the dst IP address back to the ens4f0 address.

114
0 + 2
QF0 avatar
gu flag
QF0
Hi @A.B: for XY, the actual problem is basically #3: carry out a loopback test using a single network card. The loopback goes through external test kit, but can be considered to be a simple Ethernet loopback cable. I force the traffic to go externally by defining a dummy IP address (132) and `ip neigh add`. I know this works, and the external traffic is returned to `ens4f0`. The problem is then to read the packet. I'm hoping to do this with NAT, by changing the dummy address (132) to the real IP address of the card (129). However, I don't think NAT is working.
0
Reply
A.B avatar
cl flag
A.B
I deleted my comment because I think every of the 3 points have problems. socat usage, using stateful nat with a stateless nat in front of it, using looped back traffic with same addresses all this in a context of nat. description doesn't match the command. eg: "the firewall is set to convert this to 192.168.50.129" doesn't match "--to 192.168.50.132" . And for the goal I was asking: for what application will that be useful, not how it's done, but why it's done.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.