4

This blog post has a template iptables rule to forward traffic, to and from the router to another ip address.

    iptables -t mangle -A POSTROUTING \
    -d [IP to spy on] \
    -j ROUTE –tee –gw [IP of wireshark]

   iptables -t mangle -A PREROUTING \
    -s [IP to spy on] \
    -j ROUTE –tee –gw [IP of wireshark]

I have not tested the command since I have no one specific ip that I want to spy on.

I have however attempted the following which seems to be have a syntax issue:

    iptables -t mangle -A POSTROUTING \
    -j ROUTE –tee –gw [IP of wireshark]

   iptables -t mangle -A PREROUTING \
    -j ROUTE –tee –gw [IP of wireshark]

With the error:

Try `iptables -h' or 'iptables --help' for more information.
Bad argument `–tee'
Try `iptables -h' or 'iptables --help' for more information.
Bad argument `–tee'

I then found the following post which had no effect: Mirror Port via iptables

End goal, duplicate all traffic, incoming and outgoing, from all sources and all destinations to a specific ip.

15

The ROUTE patch is a kernel patch which needs to be applied to the Linux Kernel source code for iptables to work: you can find here all relevant information. However, the patches detailed in this Web page are quite old (2005) and I am not sure they work properly on new kernel releases.

Instead, new iptables extensions are detailed here and these do work. In particular, it is stated that:

iptables can use extended target modules: the following are included in the standard distribution.

and thus they should be available to anyone with a standard Linux release. One of the target extensions is TEE, for which they state:

TEE

The TEE target will clone a packet and redirect this clone to another machine on the local network segment. In other words, the nexthop must be the target, or you will have to configure the nexthop to forward it further if so desired.

--gateway ipaddr

Send the cloned packet to the host reachable at the given IP address. Use of 0.0.0.0 (for IPv4 packets) or :: (IPv6) is invalid.

To forward all incoming traffic on eth0 to an Network Layer logging box:

-t mangle -A PREROUTING -i eth0 -j TEE --gateway 2001:db8::1

The name TEE is clearly intended to remind one of the standard tee command, which reads from standard input and clones the output (that just goes to standard output) to a user-specified file. Same thing here with packets: packets to which the rule applies are duplicated, one being sent to its intended destination, while the newly minted clone is sent to the spying target.

Thus, to clone all incoming and outgoing traffic for pc 192.168.1.15 on your router (say, 192.168.1.1). and redirect to a spying pc 192.168.1.100, use:

 iptables -t mangle -A PREROUTING -d 192.168.1.15 -j TEE --gateway 192.168.1.100
 iptables -t mangle -A PREROUTING -s 192.168.1.15 -j TEE --gateway 192.168.1.100
  • Supposing the gateway does not only listen but responds to the cloned traffic -- what will happen to the responses from the "spy"? Will they be dropped or sent out? – jotrocken Mar 28 '17 at 10:13
  • @jotrocken There need not be a reply from the spy: for instance if it has no application listening on the destination port. If there is a reply, it will be (most likely) discarded by the original source pc because there is no established TCP connection (=no handshake) between it and the spy, or because UDP replies from pcs different than those with which the conversation has been started are routinely discarded to prevent mitm attacks. Normally, packets on the spy are logged for later, possibly offline study. – MariusMatutiae Mar 28 '17 at 10:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.