This blog post has a template iptables rule to forward traffic, to and from the router to another ip address.

    iptables -t mangle -A POSTROUTING \
    -d [IP to spy on] \
    -j ROUTE –tee –gw [IP of wireshark]

   iptables -t mangle -A PREROUTING \
    -s [IP to spy on] \
    -j ROUTE –tee –gw [IP of wireshark]

I have not tested the command since I have no one specific ip that I want to spy on.

I have however attempted the following which seems to be have a syntax issue:

    iptables -t mangle -A POSTROUTING \
    -j ROUTE –tee –gw [IP of wireshark]

   iptables -t mangle -A PREROUTING \
    -j ROUTE –tee –gw [IP of wireshark]

With the error:

Try `iptables -h' or 'iptables --help' for more information.
Bad argument `–tee'
Try `iptables -h' or 'iptables --help' for more information.
Bad argument `–tee'

I then found the following post which had no effect: Mirror Port via iptables

End goal, duplicate all traffic, incoming and outgoing, from all sources and all destinations to a specific ip.

1 Answer 1


The ROUTE patch is a kernel patch which needs to be applied to the Linux Kernel source code for iptables to work: you can find here all relevant information. However, the patches detailed in this Web page are quite old (2005) and I am not sure they work properly on new kernel releases.

Instead, new iptables extensions are detailed here and these do work. In particular, it is stated that:

iptables can use extended target modules: the following are included in the standard distribution.

and thus they should be available to anyone with a standard Linux release. One of the target extensions is TEE, for which they state:


The TEE target will clone a packet and redirect this clone to another machine on the local network segment. In other words, the nexthop must be the target, or you will have to configure the nexthop to forward it further if so desired.

--gateway ipaddr

Send the cloned packet to the host reachable at the given IP address. Use of (for IPv4 packets) or :: (IPv6) is invalid.

To forward all incoming traffic on eth0 to an Network Layer logging box:

-t mangle -A PREROUTING -i eth0 -j TEE --gateway 2001:db8::1

The name TEE is clearly intended to remind one of the standard tee command, which reads from standard input and clones the output (that just goes to standard output) to a user-specified file. Same thing here with packets: packets to which the rule applies are duplicated, one being sent to its intended destination, while the newly minted clone is sent to the spying target.

Thus, to clone all incoming and outgoing traffic for pc on your router (say, and redirect to a spying pc, use:

 iptables -t mangle -A PREROUTING -d -j TEE --gateway
 iptables -t mangle -A PREROUTING -s -j TEE --gateway
  • Supposing the gateway does not only listen but responds to the cloned traffic -- what will happen to the responses from the "spy"? Will they be dropped or sent out?
    – jotrocken
    Mar 28, 2017 at 10:13
  • @jotrocken There need not be a reply from the spy: for instance if it has no application listening on the destination port. If there is a reply, it will be (most likely) discarded by the original source pc because there is no established TCP connection (=no handshake) between it and the spy, or because UDP replies from pcs different than those with which the conversation has been started are routinely discarded to prevent mitm attacks. Normally, packets on the spy are logged for later, possibly offline study. Mar 28, 2017 at 10:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .