Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a fron-end machine. Machine have2 eth cards. I want to use netfilter queue to do some checks on the packets.

I set eth like this: ifconfig eth0 promisc up ifconfig eth1 promisc up

I want to have an iptable rule like this(only example): iptables -A INPUT -i eth0 -j LOG --log-prefix " eth0 packet "

but the packet is no passed through the iptables ,because it dosnt target to this MAC. Promisc mode didnt help.

I saw that there is a way to add iptables chain for PROMISC, but need compilation... Is there any simplier way to have iptables rule when packet is not target to this eth.

Currently i bypass this by creating a bridge between 2 eth and put rule on the FORWARD, but i done want to create bridge.

share|improve this question
up vote 1 down vote accepted

Remember that on a network that's connected with Ethernet switches, you won't see most of the data even if the network card is in promiscuous mode unless you have a managed switch with port mirroring.

One way to achieve what you want is to use an arp poisoning tool, such as Ettercap. You should be able to then apply netfilter rules or tcpdump the information you require.

Edit - More detail on request of OP:

From your question it sounds like you wish to snoop on passing network traffic and pass it through iptables.

By using a bridge, you're able to achieve this by sitting between the interesting machines and their gateway, physically, but it sounds like you would like to do in more passive fashion, hence why you're trying to use promiscuous mode on the NICs. Right? (If you don't know, promiscuous mode allows you too see Ethernet frames that were not addressed to your NIC)

The problem you have is that an Ethernet switch is designed so that it learns the MAC addresses on each port and uses this to "route" Ethernet frames to the correct port based on their MAC address. This is to reduce collisions associated with Ethernet hubs (something you rarely see these days). Therefore, you will only see Ethernet frames destined to or originating from your NIC including broadcast Ethernet frames, such as ARP, but not foreign traffic. This is a good thing :)

Most managed switches (not a dumb desktop one) allow you to designate a port mirror so that all Ethernet frames are replicated on a specific port where you can attach a machine in promiscuous mode and capture "foreign" Ethernet frames using tcpdump/Wireshark.

This still won't let them be captured by iptables, however. So you need a way to act as an Ethernet bridge again between the interesting hosts and their gateway but without being physically in the path. Enter Ettercap which is an arp poisoning tool. It tricks your interested hosts (and the switch) that your machine MAC address now owns the IP of the old IP gateway by sending out a "gratuitous arp". The interesting machines will unwittingly send all gateway/default route destined traffic to your machine. Your machine will now forward packets through its IP stack as if it was the gateway.

Where this won't work is when "port security" has been enabled on the switch, a not uncommon practice. This is to stop arp poisoning by blocking gratuitous arps where an IP is moving from one Ethernet port to another.

share|improve this answer
Can you please expand you answer. Why i will not see when network connected with Ethernet switches ? If i use Ettercap how this help me for netfilter rule? – Avihai Marchiano Oct 13 '12 at 10:10
@user1495181 yup updated answer with more detail – Alastair McCormack Oct 13 '12 at 18:53

As to me you seem to lack of clear understanding of what your needs are. That's why you're having difficulties to implement this.

The main question isn't iptables' "suitable chain" but how to get traffic flowing into the box and then how to handle it with OS kernel or userspace.

Bridge is quite natural way but actually I don't see how would FORWARD-chain, which by definition is for forwarding, help in handling that switched traffic.

You certainly have to have this traffic being forwarded through, and it means, that your comp. should be a router for that traffic. If you can manage it in a natural way — go for it. In case you have no such a possibility, I'd say that something like proxy_arp mechanism could probably help.

UPD.: I was re-reading LARTC recently, and ran into "Pseudo-bridges with Proxy-ARP" which made me realize that my suggestion was really suitable.

share|improve this answer
You half right. I know what i needs and i already implement it by bridge. This is a middle box that need to do some logic. The box is now defined as bridge with rule on forward that put all packets in nfqeue and i read them from the queue. The bridge in only a hack in order to have the ability to put packets in queue. I wish to define it on input chain , but i even promisc dosnt help me. – Avihai Marchiano Oct 11 '12 at 19:32
@user1495181, well I didn't say you didn't know. I said it looks like it's unclear. As it's being said "properly stated question contains half of the answer". – poige Oct 11 '12 at 19:42
@user1495181, see UPD. – poige Oct 15 '12 at 7:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.