tcp checksum after port translation

From: Giacomo (jacum_at_libero.it)
Date: 09/14/05 

Date: Wed, 14 Sep 2005 18:31:50 GMT

Good morning, i calculate tcp checksum after changing a destination port
(nat)

For example: A (192.168.0.2) sends ssh to 192.168.0.1 : 222 (B) and packets
are redirected to 192.168.0.1 : 22

After changing port, i recalculate checksum in prerouting on B.

B responds to A, sending response from port 22, so I change in postrouting
the source port to 222, the one
A expects from.

Then I recalculate checksum.
In post routing I printk the checksum recalculated by B: it is correct,
according to the checksum expected
by A (ethereal confirms that).

The fact is that A receives back always the same checksum different from the
right one.

Why do i read the correct checksum in B postrouting and then A receives a
bad value?
Has it to do with HW_CHECKSUM?? (and what is that?)

This happens to machine B (amd athlon, realtek 8139, via motherboard),
towards A
(intel P4, natsemi net card, intel chipset).

If I invert roles, it works!!
(P4 machine responds ok to this kind of redirect).

If I insert module iptable_nat, it works!!

Without, checksum seems to be set correctly in postrouting skb, but arrives
wrong and always the same (0x81a5).
Someone changes checksum after postrouting netfilter hook??

the packet flow is

PREROUTING ->(redirect) -> INPUT ->SSH-> OUTPUT->POSTROUTING (de-dport
translation)

If I redirect port and IP all works fine (PRE->FWD->POST)

Thanks for any idea of what's going wrong
GIacomo-

Relevant Pages

  • Re: Solaris 8 - Configuring sendmail relay (NoAuth inbound -> SSL outbound)
    ... ISP's SMTP server using SSL, port 465, with user/pass auth. ... Frame 4 ... [Time delta from previous displayed frame: ... Header checksum: 0x1cfa ...
    (comp.mail.sendmail)
  • Re: Apache 1.3.26 port
    ... >> I, in fact, just went through this and would beg to differ. ... Have you ever heard of backups? ... The port shouldn't be rm -rf'ing anything. ... remove a file if the checksum does not match the checksum that it had upon ...
    (FreeBSD-Security)
  • OpenOffice ports & packages fail on 5.2 system
    ... I tried installing openoffice-1.1 first... ... If you are absolutely sure you want to override this ... I'm a little nervous about overriding the checksum... ... or is the checksum really incorrect for the port? ...
    (freebsd-questions)
  • tcp checksum after port translation
    ... After changing port, i recalculate checksum in prerouting on B. ... B responds to A, sending response from port 22, so I change in postrouting ...
    (comp.os.linux.networking)
  • Re: Tcp header
    ... just ready function to calculate checksum you can take from ... listening socket, ... The port shouldn't be 80 ... You can find all this in the RFC 793 (Transmission Control Protocol) ...
    (microsoft.public.win32.programmer.networks)