Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to come up with an iptables rule whereby I can redirect all tcp traffic incoming on eth0 to I will then listen on with my C program and print the raw packets to console. Is this possible? Or am I going about this in completely the wrong way?

Please bear in mind that my iptables knowledge is very limited.

Here's what I've tried sofar:

sudo iptables -A INPUT -s -p tcp -j DROP

but I don't want to DROP - I want to forward to!

share|improve this question

closed as off-topic by HopelessN00b, Ward, Andrew Schulman, kasperd, Jenny D Oct 2 '14 at 7:59

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – HopelessN00b, Ward, Andrew Schulman, Jenny D
If this question can be reworded to fit the rules in the help center, please edit the question.

… what are you actually trying to accomplish? I guarantee you there's a better way to do things if you just tell us what you're trying to do here. – MikeyB Mar 15 '12 at 16:04
Perhaps a honeypot? – qroberts Mar 15 '12 at 16:06
Why not using Wireshark? – ghm1014 Mar 15 '12 at 16:14

First enable routing:

 echo 1 > /proc/sys/net/ipv4/ip_forward

Try this:

iptables -A PREROUTING -t nat -p tcp -i eth0  -j DNAT --to

Optional to hide the real IP: iptables -t nat -A POSTROUTING -j MASQUERADE

share|improve this answer
I think MASQUERADE is not necessary, will hide real source IP – ghm1014 Mar 15 '12 at 16:15

It's a much better idea to configure iptables to send the packets to your process using netlink (search for NFLOG in the iptables manpage) or just capture raw traffic with libpcap.

This way you won't lose information and you'll keep things simple.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.