page1
Client
Hypervisor
br0
br1
rp_filter is loose – packet is accepted
because of default route. No explicit
route to client, therefore default
route (br0) is used. But address swap
makes source address be br1.
br1 echo
request
br1 echo
reply
br1 echo
request
1
Legend:
- number is sequence
Step:
packet:
Source - br1
Destination - client
Source: br1, From NIC: br0
Path mis-match – rp_filter
criteria violation: drop!
packet:
Source: client
Destination: br1
2
3
4
Linux-based router,
using strict rp_filter
5
eth1
eth2
eth0
Hypervisor
www.draw-shapes.de
Router 3
www.draw-shapes.de