Quote:
If you're sniffing on the server then it's possible that you'd see the reply coming from the correct address but going via the default gateway where (presumably) it gets dropped upstream because the address appears to be spoofed.



Yeah, unfortunately it is the only place I can sniff. Both routers and both servers are all connected to the same Ethernet segment.

I tried putting some firewall rules on the routers to spot the packets, but couldn't see them on either router.
_________________________
Remind me to change my signature to something more interesting someday