Add a filter rule:
iptables -t nat -I PREROUTING 2000 -p icmp -j DNAT --to-destination 127.0.0.1
Ping this host, the packets are dropped.
Debug steps:
1. cat /proc/net/nf_conntrack
Nothing is shown.
2. conntrack -E
No conntrack event
3. cat cat /proc/net/stat/ip_conntrack
No clue
00000005 00000124 00000064 00000000 00000000 00000002 00000042 00000000 00000004 00000005 00000000 00000000 00000000 00000000 00000000 00000001 00000000
00000042 is in_martian_dst. Review the function ip_route_input_slow() we can see that the packets are dropped through
if (ipv4_is_lbcast(daddr) || ipv4_is_zeronet(daddr) ||
ipv4_is_loopback(daddr))
goto martian_destination;
...
martian_destination:
RT_CACHE_STAT_INC(in_martian_dst);
The document: 专家们公认的20个最危险的安全漏洞 shows why those packets should be dropped.