0

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the subnet information of the LANs (not this: dst net subnetB)?

3
  • Never heard of Wireshark?
    – Chopper3
    Jan 21, 2013 at 18:47
  • As I know in wireshark, we choose one interface and then we apply filter. How can I filter inbound traffic?
    – Yasser
    Jan 21, 2013 at 18:54
  • As I read here, "it's impossible to dump a single interface and know the direction".
    – Yasser
    Jan 22, 2013 at 9:59

1 Answer 1

0

I didn't fully understand what you want, but if you want to capture packets that are forwarded (as in, routed) by the kernel from interface eth0 to interface eth1, you can add this iptables rule :

iptables -A FORWARD -i eth0 -o eth1 -j NFLOG

Then, use tcpdump or wireshark to capture packets from the Netfilter Log pseudo-interface (tcpdump works by using nflog as the interface name), which reads the packets that are seen by the NFLOG target.

If you also want to log packets that goes the other way around, just insert another iptables rule:

iptables -A FORWARD -i eth0 -o eth1 -j NFLOG

Only packets that are actually forwarded can be seen from wireshark/tcpdump. Packets that are sent from the host, or are received without being forwarded are not captured. But you can still decide to capture them by adding more NFLOG rules in INPUT or OUTPUT.

Also, watch out for the CPU usage: it can be slower to use NFLOG than to capture directly from an interface.

1
  • Thanks. Actually I want to count the number of new src/dst IP addresses passing from one side to other side of my router in time intervals. I need to know the direction of packets. Not the client/server direction. So I thought if I filter the incoming packets, I can count them. Is there a better way?
    – Yasser
    Jan 21, 2013 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .