Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs.

Basically eth0 is used for normal application traffic and eth1 is used only for debugging purposes. Debugging means that eth1 is linked using a cross cable to another linux box (let it be B) which runs Wireshark. I want Wireshark to be able to process application packets travelling on A's eth0.

Basically I need to copy travelling packets from eth0 interface to interface eth1 so that Wireshark on box B can sniff them (for some reasons I don't have physical access to LAN eth0). I could also need to specify which packets to copy from eth0 to eth1 according to some rule (based only on TCP/IP fields by the way).

Also note that A's eth0 don't need to be put in promiscuous mode because I only want to copy a subset of packets which have A as destination

Is there a way to achieve this using iptables alone? Or do i need to write an application to make this work? What should I do to "copy" the packets?

share|improve this question
up vote 5 down vote accepted

If your kernel is recent enough you could use iptables --tee to forward frames from eth0 to the capture machine.

Edit: Updated link since the original one is now behind a password prompt.

share|improve this answer
That link is now password protected. – Pipe Feb 18 '15 at 13:32

Search the net for tcpbridge. This is exactly what does the Job. Can be used to Tal virtual machines as well. This is how Inuse it.

share|improve this answer

You can use tc mirred action. For example: For incoming traffic:

tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: \
   protocol all prio 2 u32 \
   match u32 0 0 flowid 1:1 \
   action mirred egress mirror dev eth1

For outgoing traffic:

tc qdisc replace dev eth0 parent root handle 10: prio
tc filter add dev eth0 parent 10: \
   protocol all prio 2 u32 \
   match u32 0 0 flowid 10:1 \
   action mirred egress mirror dev eth1
share|improve this answer

Something like rinetd might work (redirector/server for TCP only I believe, so no ARP, Layer 2, etc.), but in all honesty, getting some managed switches that have port mirroring capabilities or if that box is solely used for wireshark, you could add another NIC to it, bridge the two interfaces, put it in front of machine A's eth0, and have a dedicated sniffing machine.

share|improve this answer

A device that copies ethernet frames from one interface to another is a bridge. You can configure your Linux system to act as a bridge. Some documentation can be found here:

You can apply filtering rules to bridged traffic using ebtables, which is an analog of iptables for layer 2 traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.