I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the subnet information of the LANs (not this: dst net subnetB)?
-
Never heard of Wireshark?– Chopper3Jan 21, 2013 at 18:47
-
As I know in wireshark, we choose one interface and then we apply filter. How can I filter inbound traffic?– YasserJan 21, 2013 at 18:54
-
As I read here, "it's impossible to dump a single interface and know the direction".– YasserJan 22, 2013 at 9:59
1 Answer
I didn't fully understand what you want, but if you want to capture packets that are forwarded (as in, routed) by the kernel from interface eth0
to interface eth1
, you can add this iptables
rule :
iptables -A FORWARD -i eth0 -o eth1 -j NFLOG
Then, use tcpdump
or wireshark
to capture packets from the Netfilter Log pseudo-interface (tcpdump
works by using nflog
as the interface name), which reads the packets that are seen by the NFLOG
target.
If you also want to log packets that goes the other way around, just insert another iptables rule:
iptables -A FORWARD -i eth0 -o eth1 -j NFLOG
Only packets that are actually forwarded can be seen from wireshark/tcpdump. Packets that are sent from the host, or are received without being forwarded are not captured. But you can still decide to capture them by adding more NFLOG rules in INPUT
or OUTPUT
.
Also, watch out for the CPU usage: it can be slower to use NFLOG
than to capture directly from an interface.
-
Thanks. Actually I want to count the number of new src/dst IP addresses passing from one side to other side of my router in time intervals. I need to know the direction of packets. Not the client/server direction. So I thought if I filter the incoming packets, I can count them. Is there a better way?– YasserJan 21, 2013 at 19:09