[Click] Problems Filtering Packets

betamaz betamaz at gmail.com
Tue Mar 1 23:51:09 EST 2005


Hi,

I'm using the conf/print-pings.click file (showed below) by pinging
ssh-ing into another machine and pinging the current one that is
running 'click  print-pings.click' but do not see any icmp messages
being captured.  I tried disabling the IPFilter inorder to see all
messages being captured (the result is shown below). I am assuming
icmp messages are being created since the sending machine is receiving
an echo reply from the destination.

I have two questions: Why do I not see any Icmp messages being
captured by the click configuration file?
Also, is there another process by which I can capture icmp messages?

Thanks in advance,
Bita.

-----------------------------------------------------
configuration file: 
// print-pings.click

// This configuration reads packets from a device, and prints out any ICMP
// echo requests it receives.


FromDevice(eth0)				
						
   -> Classifier(12/0800)			
   -> Strip(14)					
   -> CheckIPHeader				
   -> IPFilter(allow icmp && icmp type echo)	
//   -> IPFilter(allow udp)
   -> IPPrint(ascii)					
   -> Discard;

-----------------------------------------------------
sender pinging:

# ping 128.111.40.189
PING 128.111.40.189 (128.111.40.189) 56(84) bytes of data.
64 bytes from 128.111.40.189: icmp_seq=0 ttl=64 time=0.047 ms
64 bytes from 128.111.40.189: icmp_seq=1 ttl=64 time=0.045 ms
64 bytes from 128.111.40.189: icmp_seq=2 ttl=64 time=0.043 ms

-----------------------------------------------------
machine running click:

# click print-pings.click
ascii: 1109737521.674002: 128.111.40.186.631 > 128.111.40.255.631: udp 98
ascii: 1109737525.559222: 128.111.40.2 > 224.0.0.5: ip-proto-89
ascii: 1109737526.039666: 128.111.40.210.138 > 128.111.40.255.138: udp 213
ascii: 1109737529.251329: 128.111.40.2 > 224.0.0.1: ip-proto-2
ascii: 1109737529.851687: 128.111.40.116 > 239.255.255.250: ip-proto-2
ascii: 1109737530.671170: 128.111.40.184.631 > 128.111.40.255.631: udp 100
ascii: 1109737530.671292: 128.111.40.184.631 > 128.111.40.255.631: udp 149
ascii: 1109737531.359330: 128.111.40.249 > 224.0.1.60: ip-proto-2
ascii: 1109737531.671086: 128.111.40.158.631 > 255.255.255.255.631: udp 144
ascii: 1109737532.321539: 128.111.40.171 > 224.0.0.251: ip-proto-2
ascii: 1109737532.914212: 128.111.40.30 > 224.0.1.1: ip-proto-2
ascii: 1109737535.559804: 128.111.40.2 > 224.0.0.5: ip-proto-89


More information about the click mailing list