<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:16px"><div id="yui_3_16_0_1_1431457468758_2546"> msg = of.ofp_flow_mod()<br style="" class=""> msg.priority = 42<br style="" class=""> msg.match.dl_type=0x800<br style="" class=""> msg.idle_timeout = 40<br style="" class=""> msg.hard_timeout = 40<br style="" class=""> msg.match.nw_dst = IPAddr("10.0.0.2")<br style="" class=""> msg.actions.append(of.ofp_action_nw_addr.set_dst(IPAddr("10.0.0.4")))<br style="" class=""> msg.actions.append(of.ofp_action_output(port = 4))<br style="" class=""> self.connection.send(msg)<br style="" class=""> msg = of.ofp_flow_mod()<br style="" class=""> msg.priority = 42<br style="" class=""> msg.match.dl_type=0x800<br style="" class=""> msg.idle_timeout = 40<br style="" class=""> msg.hard_timeout = 40<br style="" class=""> msg.match.nw_dst = IPAddr(src_ip)<br style="" class=""> msg.actions.append(of.ofp_action_nw_addr.set_src(IPAddr("10.0.0.2")))<br style="" class=""> msg.actions.append(of.ofp_action_output(port = myport))<br style="" class=""> self.connection.send(msg)</div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2524" dir="ltr"><br style="" class=""></div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2597" dir="ltr">I have a switch and 3 hosts.I assume that 10.0.0.3 is the attacker and 10.0.0.2 and 10.0.0.4 are two(supposed) honeypots.(i use mininet)<br style="" class=""></div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2723" dir="ltr">When
there are a lot of packets towards .2 honeypot i want to redirect the
traffic to .4.So i install a rule for ip spoofing to .4 and i send it to
port 4.Moreover there is a flow for the replies from 10.0.0.4.</div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2640" dir="ltr">The
thing is that i send echo requests to .2 ,switch succeessfully changes
it to .4 and sends is from the correct port.But h4 drops it and doesn't send
any echo reply.<br style="" class=""></div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2686" dir="ltr">The
even more bizzar thing is that i can ping from .4 to .3 and .3 sees is
as .2.(ping show that packets drop,but with tcpdump i can see full
duplex communication,wtf is going on) :/</div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2736" dir="ltr"><br style="" class=""></div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2737" dir="ltr">I
cannot understand if it's a pox bug when it modifies src or destination
ip,or mininet bug.Or if you could suggest any other solution.</div><div style="" class="" id="yiv9474250459yui_3_16_0_1_1431451916262_2790" dir="ltr">To
sum up the consept is,i want to send packets from .3 to .2 and when an
event accurs to send them to .4 But the attacker should see that
communicates always with .2 and not .4 (that's why i want to modify ip 2
times)</div><div style="" class="" id="yui_3_16_0_1_1431456805066_37241" dir="ltr">Thanks in advance !!!!</div><div dir="ltr" style="" class="" id="yui_3_16_0_1_1431456805066_37172"><br style="" class=""></div><div style="" class="" id="yui_3_16_0_1_1431457468758_2546"><br style="" class=""></div></div></body></html>