I'd like to capture a HTTP service call from HostA -> HostB to test the client on HostA for replace the HTTP response. Both OS are Linux. I tried following but fail. What's the recommended way to do this?

I would like to use transparent proxy mode because I cannot modify client and cannot redirect all traffic from HostA to hostB as other service also running on HostA. I'd like only redirect the connection of the client from host A to host B. The client in Host A call a service on Host B on a certain port 10001 by HTTP.

I tried setup HostC with mitmproxy (HostA and HostC are in the same subnet) HostA (ip_A) -> HostC(ip_C) with mitmproxy-> HostB(ip_B) , I set the ip table to build transparent mode.

Following is what I setup for on HostA

sudo iptables -t mangle -I OUTPUT -p tcp --dport 10001 -j MARK --set-mark 1
sudo ip route add default via ip_C table 100
sudo ip rule add fwmark 0x1 table 100

On HostC

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A PREROUTING -o eth0 -p tcp --dport 10001 -j REDIRECT --to-port 8080
mitmproxy -T --host

This doesn't work. client on HostA connection timeout. If I try traceroute on HostA

traceroute ip_B -p 10001 -T

It shows ip_B is unreachable on TCP from HostA

I also tried setup mitmproxy on HostA, but when I try to redirect traffic of port 10001 on HostA

sudo iptables -t nat -A OUTPUT -p tcp --dport 10001 -j REDIRECT --to-port 8080
mitmproxy -T --host

The service call could be capture by mitmproxy on HostA but cannot get response.

Thanks a lot for your help.

  • Sorry for typo, it's 10001. – shikn Jan 8 '18 at 4:23
  • What are you really trying to do? You just want to see the traffic? Whats wrong with just using a switch with port mirroring turned on and wireshark or tcpdump? – Appleoddity Jan 8 '18 at 5:45
  • Oh, I want to capture response and replace response for the request from HostA. – shikn Jan 8 '18 at 7:15
  • Perhaps a complete change of software might help see softwarerecs.stackexchange.com/questions/4239/… – Ross Jan 9 '18 at 1:02

Perhaps - once the packets gets to the MITM server its now going to port 8080 - but the HOST_A Web Server is still on 10001 - so won't you need to do another IPTABLES to put it back to 10001? I think your better than me at that but I'd guess

sudo iptables -t nat -A OUTPUT -p tcp --dport 8080 -j REDIRECT --to-port 10001

would do it

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.