3 ms·
You'll want to have kernel sources handy. In this case you can see the packet ending up in nf_hook_slow function: https://elixir.bootlin.com/linux/latest/source
by zokier 4y ago
You'll want to have kernel sources handy. In this case you can see the packet ending up in nf_hook_slow function: https://elixir.bootlin.com/linux/latest/source/net/netfilter/core.c#L607 https://elixir.bootlin.com/linux/latest/source/net/netfilter...
from there you can see only one branch leading to kfree_skb, so you can make a guess that some netfilter "hook" returned NF_DROP. From that you might already be able to make educated guesses that it might be iptables rule, or continue delving deeper to figure out what those hooks are etc
- ralgozino 4y agothank you! TIL. I guess you need a completely different mindset to approach this.
- liotier 4y ago> make educated guesses that it might be iptables rule, or continue delving deeper to figure out what those hooks are etc Would it be a good idea to let pwru dig into the iptables detour to provide the whole view of the packet's journey - or is iptables at a different layer whose observability is best left to another tool ?