I have a strange case where I don't know what happen. Usually using
tcpdump shall allow us to know if a packet reach to the NIC before
iptable filter. This works so far on most UDP port I tried but not port
I have a server (IP:
# tcpdump -nnvv src host 192.168.0.128
192.168.0.10 are connected non managed switch. The network is working fine. I can ping each others and I even can connect to other TCP services.
When I send a UDP traffic from host
# echo "test" > /dev/udp/192.168.0.10/100
I receive response from
12:29:09.210977 IP (tos 0x0, ttl 64, id 50828, offset 0, flags [DF], proto UDP (17), length 33) 192.168.0.128.33701 > 192.168.0.10.100: [udp sum ok] UDP, length 5 12:29:14.211507 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.0.128 is-at 00:0c:29:e8:30:d4, length 46
Even the UDP port
100 isn't listened by any service. I also try other UDP port like
102. All these ports work perfectly well.
Next I try send a UDP traffic to port 69:
# echo "test" > /dev/udp/192.168.0.10/69
And I receive no response
tcpdump. As port
69 is usually used by
tftp service. I perform this test is trying to troubleshot why the
tftp listen on port 69 isn't showing any response. I also make sure the tftp service is stop before I do the test.
My Linux kernel is:
# uname -a Linux local 126.96.36.199-85.fc13.x86_64 #1 SMP Thu May 6 18:09:49 UTC 2010 x86_64 x86_64 x86_64 GNU/Linux
Is there any other setting in Linux box that hijack the UDP port 69 traffic?