Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use tcpdump to capture output packets for one server, but I also need to block these packets.

If I use iptables to block them, then I also can not capture anything.

Can I block packets with iptables and still capture the packets before they are dropped?

share|improve this question
up vote 2 down vote accepted

I'd use a passive (un-addressed) interface to capture, and a second interface (addressed) to block.

To setup an interface for capture, without an address, you do: ifconfig eth0 up

You may need to hack on your switch to make this all fly, but the essence is: mirror all traffic to both interfaces (i.e. switch ports), and then capture on the one, and filter on the other.

share|improve this answer

if i understand, you want to block connection but capture packets.

you can do this by using MARKS

for example if you want block connection for host with connection*nix) you can do with this

iptables -t mangle -A PREROUTING -s -j CONNMARK --set-mark 1
iptables -t mangle -A POSTROUTING -m connmark --mark 1 -j DROP
share|improve this answer
Thanks! Can i block gre packets but can capture them with this rule ? – larry Nov 30 '10 at 11:21
but i can capture input packets, but can not capture the output packets :( – larry Nov 30 '10 at 11:35

You could use a fairly simple snort ruleset to "log" packets as well as drop or refuse them: Snort. However, there are several prerequisites and it is yet another syntax to learn so there is quite an overhead. Snort :: Docs has quick-start guides for several different operating systems.

share|improve this answer

You cannot block packets on the raw socket, because there is no filter for it currently. Above all, the raw socket gets the packet, in fact, even a copy of the packet, before the IPv4 tap and iptables do get theirs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.