Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs.

Basically eth0 is used for normal application traffic and eth1 is used only for debugging purposes. Debugging means that eth1 is linked using a cross cable to another linux box (let it be B) which runs Wireshark. I want Wireshark to be able to process application packets travelling on A's eth0.

Basically I need to copy travelling packets from eth0 interface to interface eth1 so that Wireshark on box B can sniff them (for some reasons I don't have physical access to LAN eth0). I could also need to specify which packets to copy from eth0 to eth1 according to some rule (based only on TCP/IP fields by the way).

Also note that A's eth0 don't need to be put in promiscuous mode because I only want to copy a subset of packets which have A as destination

Is there a way to achieve this using iptables alone? Or do i need to write an application to make this work? What should I do to "copy" the packets?

share|improve this question
add comment

4 Answers 4

up vote 5 down vote accepted

If your kernel is recent enough you could use iptables --tee to forward frames from eth0 to the capture machine.

share|improve this answer
add comment

Something like rinetd might work (redirector/server for TCP only I believe, so no ARP, Layer 2, etc.), but in all honesty, getting some managed switches that have port mirroring capabilities or if that box is solely used for wireshark, you could add another NIC to it, bridge the two interfaces, put it in front of machine A's eth0, and have a dedicated sniffing machine.

share|improve this answer
add comment

A device that copies ethernet frames from one interface to another is a bridge. You can configure your Linux system to act as a bridge. Some documentation can be found here:

You can apply filtering rules to bridged traffic using ebtables, which is an analog of iptables for layer 2 traffic.

share|improve this answer
add comment

Search the net for tcpbridge. This is exactly what does the Job. Can be used to Tal virtual machines as well. This is how Inuse it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.