Network & Infrastructure / Linux Networking & Host Performance
Linux reverse-path filtering on an asymmetric multihomed host
A multihomed server receives a request in a packet capture but never delivers it to the application. Reverse-path validation may reject the packet because the preferred return route differs.
Environment and inputs: Linux network namespaces, host routing and network drivers; availability and semantics depend on kernel and driver versions. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Inspect effective reverse-path settings for all and per-interface scopes, policy routes, source address and drop evidence. Check the actual kernel documentation for how these settings combine.
Explain the result
Ingress visibility in a capture does not establish delivery to the socket. Reverse-path checks can discard a packet after it reaches the NIC when routing and validation assumptions disagree.
Plan the fix
Align source validation with the legitimate topology using supported scoped settings and routing policy. Preserve anti-spoofing through appropriate boundaries instead of disabling every check on the host.
Check the result and rollback
Test approved asymmetric flows and disallowed source addresses in isolation. Restore previous settings if spoofed traffic becomes acceptable or the change fails to repair the demonstrated route mismatch.