Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently working on an application that is able to conduct ARP poisoning so as to become the man in the middle and do some intelligent filtering. I will explain the problem in details in steps so as to let you guys know what is going on.

I have 4 hosts namely:

  • A -
  • B -
  • C -
  • D -

Host A is the man in the middle so all traffic within the network will be redirected to him.

Say Host B wants to ping Host C, but since host A is the MITM, the ping will be redirected to host A. My application at host A must be able to forward the ping packet to host C (its original intended route).

However, the application can decide certain packets that it wants to forward.

For example, if Host B wants to FTP to Host C this time, I would like for host A to mangle with the destination ip address for the packets so that host B's packets actually goes to host D instead (just an example, the ftp connection might not work, its ok)

The basic idea is that the application is able to redirect traffic depending on the protocol.

This is where the problem comes in, I am not sure of how can I go about doing this. I've read up on iptables and it seems that (correct me if I am wrong), iptables is able to mangle with the destination address of packets with prerouting functions.

I've also done up some searching on a particular module called libnetfilter_queue (nfqueue) which seems to be able to mangle with packets as well, though I am not exactly sure how.

Can anybody advice me on what is the correct approach that I should take? If possible, can you provide some examples which will be able to solve the problem in the scenario above?

share|improve this question
up vote 2 down vote accepted

if it is ineed true what u say and all the traffic is going trough host A, then u can use iptables on host A to redirect the traffic to other hosts then intended.

f.e.: Reroute traffic from D --> C on port 80 to B

iptables -t NAT -A PREROUTING -p tcp --dport 80 -s -d -j DNAT --to-destination 

as for your example (the FTP from B to C)

iptables -t NAT -A PREROUTING -p tcp --dport 21 -s -d -j DNAT --to-destinatin

Rerouting ALL traffic coming from B intended for C to D:

iptables -t NAT -A PREROUTING -p tcp -s -d -j DNAT --to-destination

if more examples are needed I can make up some more

share|improve this answer
Hey, thanks for the help... Btw, do you have any resources regarding nfqueue? Because I am currently exploring that option as well... – Ng Zi Kai Jul 19 '11 at 14:53
I'm sorry but I have never worked with nfqueue before. – Goez Jul 19 '11 at 15:20
Ok... thanks alot anyway! – Ng Zi Kai Jul 20 '11 at 6:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.