I thought Wireshark would see my VirtualBox lab. It can't. Internal networks are invisible from Windows. And then ping said "Network is unreachable" even though ifconfig looked fine.
This is the lab that finally routed PC1 -> VyOS -> PC2.
THE LAB
- Oracle VM VirtualBox
- VyOS eth0 192.168.10.1/24 wire-a, eth1 192.168.20.1/24 wire-b
- PC1 TinyCore 192.168.10.10/24 wire-a
- PC2 TinyCore 192.168.20.10/24 wire-b
PART 1 - CAPTURE WHERE IS THE HEX?
Wireshark on host sees nothing. You must capture inside.
On VyOS:
sudo tcpdump -i any -n -X icmp
sudo tcpdump -i any -n -xx icmp
-n = no dns, -X = HEX + ASCII, -xx = full HEX, icmp lowercase not ICMP
My HEX dump from VyOS when ping worked:
15:32:10.123456 IP 192.168.10.10 > 192.168.20.10: ICMP echo request
0x0000: 4500 0054 0000 4000 3f01 7a6b c0a8 0a0a E..T..@.?..k....
0x0010: c0a8 1414 0800 f7ff 1234 0001 6162 6364 ........4..abcd
0x0020: 6566 6768 696a 6b6c 6d6e 6f70 7172 7374 efghijklmnopqrs
0x0030: 7576 7761 6263 6465 6667 6869 uvwabcdefghi
This is what Wireshark would show if it could see internal.
PART 2 - HOW TO STOP LISTENING?
tcpdump locks terminal. You can't ping in same window.
Stop: Ctrl + C
Or run in background so you CAN ping:
sudo tcpdump -i any -n -X icmp &
ping 192.168.10.10
ping 192.168.20.10
sudo killall tcpdump
fg
Ctrl + C
The & is the trick everyone misses.
PART 3 - PING HANGS WITH NO ERROR = ARP
When I pinged and got no error, no reply, just hang - it's ARP.
VyOS doing: "Who has 192.168.10.10? Tell 192.168.10.1"
Check:
cat /proc/sys/net/ipv4/ip_forward
must be 1, if 0: sudo sysctl -w net.ipv4.ip_forward=1
ip a
show interfaces
PART 4 - THE REAL BUG - MY PHOTO
PC1 ifconfig looked OK:
eth0 Link encap:Ethernet HWaddr 08:00:27:26:50:38
inet addr:192.168.10.10 Bcast:192.168.10.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:73 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:0 (0.0 B) TX bytes:24966 (24.3 KiB)
But route -n showed:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
MISSING: 0.0.0.0 192.168.10.1
That is why: ping: sendto: Network is unreachable - it's YOUR PC saying it, not VyOS.
Cause: sudo ifconfig eth0 down / up drops IP and route. RX bytes 0 proves it.
PART 5 - FIX - THIS MADE IT ROUTE
On PC1:
sudo ifconfig eth0 down
sudo ifconfig eth0 192.168.10.10 netmask 255.255.255.0 up
sudo route add default gw 192.168.10.1 eth0
route -n
ping 192.168.10.1
ping 192.168.20.10
Now route -n must show:
0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 eth0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo
On PC2:
sudo ifconfig eth0 192.168.20.10 netmask 255.255.255.0 up
sudo route add default gw 192.168.20.1 eth0
On VyOS final test:
sudo tcpdump -i any -n -X icmp &
ping 192.168.10.10
ping 192.168.20.10
On PC1:
ping 192.168.20.10
Result: 3 packets transmitted, 3 received, 0% loss - from both PCs.
LESSON
- Wireshark can't see VirtualBox internal - use tcpdump -X inside
- tcpdump needs Ctrl+C or & + killall
- ifconfig down loses route - RX bytes 0 is clue
- route -n must have 0.0.0.0 line or you get Network unreachable before packet even leaves
What broke for you at L2/L3? Did RX 0 get you too?
Top comments (0)