Can not trace the packets to a specific gateway ip

Question

I try to make the OSX host-A to be a specific gateway for a Linux host-B. The default gateway entry of B has been deleted and add a specific gateway as below. Note: 98.136.144.138 is the ip address of domain name of "search.yahoo.com". Host-A can reach search.yahoo.com normally. ip of A is 10.192.29.246 and ip of B is 10.192.13.160.

When host-B browser refreshes the ip of 98.136.144.138, the web page shows as expected. But the Wireshark can not capture any packets illustrating the packets from host-B reach the gateway host-A first and host-A routes these packets. Why the information does not show?

• The packets Wireshark captured in host-B as below. After I add specific route and refresh 98.136.144.138 of Yahoo Search in browser of host-B, packets below the line in picture turn up. But no info upon packets to specific gateway(host-A). And how to get the packets to a gateway if necessary?

• The returns of command traceroute 98.136.144.138in host-B as below. And why the fist line is old default gateway 10.255.255.1 not specific gateway host-A. Host-A ip 10.192.29.246 even did not show .

If we can not trace or capture the data from host-B to the specific gateway(host-A) according to the routing table when browse the "Yahoo Search" page, how do we know whether it's really happened that host-B reach "Yahoo Search" page via host-A? The routing rules are on the routing table, but we need to really know that. Any help would be appreciated.

Update: add the layer II information of Wireshark below.10.192.26.24 is the host-B ip address now since restarted (But host-A is still 10.192.29.246). The first packet is sent to MAC address 00:00:5e:00:01:02 which belongs to the deleted default gateway 10.192.0.1. But how does it still be sent to deleted gateway? All following packets don't contain MAC address of host-A.

Update: And a diagram for illustrating my purpose. I am not sure this is right? Today when I retried this, host-B could access to 98.136.144.138 at first and Wireshark captured some info about "redirect". This is real communication between host-A and host-B.

However, it was really weird after a while, host-B could not access to 98.136.144.138 anymore but Wireshark captured host-B did really send packets to host-A via layer of Ethernet II and not to original deleted default gateway.

Answer 1

Your tcpdump / wireshark display shows layer 3 (IP) addresses. Communication with the gateway happens at layer 2 (Ethernet).

You should expand one (any one) of the packets below the red line, and compare the source and destination MAC addresses of the frame with the two hosts. One will be the source host (host B), and the other should be the MAC address of the gateway (host A), if things are working correctly.

The source and destination IP address of the packet won't change as it passes through the network and routers, but the MAC address of the wrapping ethernet (or other layer 2) frame will be different for every leg of that trip.

With regard to the traceroute, you can probably look up a way to configure an OS-X system to send ICMP errors so that the OS-X host shows up in traceroute, but it isn't clear that that will further your fundamental goal.