Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to see how the routing table changes on a Linux system, when an ICMP redirect is received. For that I use

icmpush -v red -sp current-gateway -gw new-gateway -dest google.com -c host -prot tcp my-eth1-ip-address

(which returns success), but the result of

route -n 

remains the same. Of course I have checked the the output of

cat /proc/sys/net/ipv4/conf/eth1/accept_redirects

which is 1. This is an Ubuntu 12 machine, with the last stable version of kernel, no firewall installed.

So the question: what could be going wrong?

share|improve this question
    
It might be that Linux only accepts redirects that were sent in reply to another packet, for security reasons. –  grawity Jan 25 '13 at 18:41
add comment

2 Answers

According to Documentation/networking/ip-sysctl.txt, by default redirects are only accepted for those gateways that are already listed in the routing table.

secure_redirects - BOOLEAN
    Accept ICMP redirect messages only for gateways,
    listed in default gateway list.
    secure_redirects for the interface will be enabled if at least one of
    conf/{all,interface}/secure_redirects is set to TRUE,
    it will be disabled otherwise
    default TRUE
share|improve this answer
add comment

An assumption: the call of icmpush does not use the external interface eth1, but rather the localhost one lo so that the kernel does not recognize that it is a correct redirect from the gateway. Besides, in very old versions of the linux kernel these routes were not displayed in the response of route -n. As I noted, the response of route -nC could be the correct way to include also the temporary redirect route.

@grawity, about accepting redirects that were sent in reply to another packet: did you read that somewhere? because I would be really interested in that.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.