Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the subnet information of the LANs (not this: dst net subnetB)?

share|improve this question
    
Never heard of Wireshark? –  Chopper3 Jan 21 '13 at 18:47
    
As I know in wireshark, we choose one interface and then we apply filter. How can I filter inbound traffic? –  Yas Jan 21 '13 at 18:54
    
As I read here, "it's impossible to dump a single interface and know the direction". –  Yas Jan 22 '13 at 9:59

1 Answer 1

I didn't fully understand what you want, but if you want to capture packets that are forwarded (as in, routed) by the kernel from interface eth0 to interface eth1, you can add this iptables rule :

iptables -A FORWARD -i eth0 -o eth1 -j NFLOG

Then, use tcpdump or wireshark to capture packets from the Netfilter Log pseudo-interface (tcpdump works by using nflog as the interface name), which reads the packets that are seen by the NFLOG target.

If you also want to log packets that goes the other way around, just insert another iptables rule:

iptables -A FORWARD -i eth0 -o eth1 -j NFLOG

Only packets that are actually forwarded can be seen from wireshark/tcpdump. Packets that are sent from the host, or are received without being forwarded are not captured. But you can still decide to capture them by adding more NFLOG rules in INPUT or OUTPUT.

Also, watch out for the CPU usage: it can be slower to use NFLOG than to capture directly from an interface.

share|improve this answer
    
Thanks. Actually I want to count the number of new src/dst IP addresses passing from one side to other side of my router in time intervals. I need to know the direction of packets. Not the client/server direction. So I thought if I filter the incoming packets, I can count them. Is there a better way? –  Yas Jan 21 '13 at 19:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.