i need to mirror all packets from port 162 to another (for example 1162) on localhost.

I know that TEE can mirror packets but to some ip address.

Maybe it is possible in one rule change also destination port, but i can't find working solution.

Something like that:

iptables -t mangle -A PREROUTING -d -j TEE --to-destination

But from manual: Send the cloned packet to the host reachable at the given IP address. Use of (for IPv4 packets) or :: (IPv6) is invalid.

Thanks for any hint.

OS:RedHat 6.9

  • 1
    What have you tried? What OS are you using? Please take our tour and see How to Ask. – Burgi Jan 26 '18 at 9:08

It seems that there are some misunderstanding :

I need to mirror all packets from port 162

your rule should include --sport 162 or --dport 162 if you meant "all packets arriving to port 162"


In fact does not match the localhost. You should use instead.

Finally you can try for TCP traffic:

iptables -t mangle -A PREROUTING -p TCP --dport 162 -j TEE --gateway
iptables -t nat -A PREROUTING -d -p TCP --dport 162 -j DNAT  --to

The first rule copies the traffic to localhost The second rule forwards traffic from to

Please note that as traditional port forwarding which apply to POSTROUTING chain, the second rule applies to PREROUTING. This is because we deals with localhost addresses so that POSTROUTING chain of nat table is not crossed by packet.

An for UDP traffic:

iptables -t mangle -A PREROUTING -p UDP --dport 162 -j TEE --gateway
iptables -t nat -A PREROUTING -d -p UDP --dport 162 -j DNAT  --to
  • Ouch looks like redhat 6.9 with version 1.4.7 doesn't have TEE functionality, we don't have module in kernel for that also. – Neci Jan 26 '18 at 13:48
  • 1
    Strange, you mentioned TEE in your question and the error looks like a TEE ` --gateway` input error (ipset.netfilter.org/iptables-extensions.man.html#lbDW). – vera Jan 26 '18 at 14:38
  • When testing this on UDP, It appears that the destination IP of the packet is not altered by the TEE rule thereby nullifying the nat rule. – QuickPrototype Mar 12 at 22:38

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.