Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a proprietary system which transmit a udp video stream from unit #1 ( to unit #2 (.1.2). I can't make changes to this system, and I'm trying to clone this udp stream so I can access it in a different program. This program will do stuff with the video and send it out again as a multicast stream.

I'm hoping to do this using a Linux machine (running Ubuntu Server 12.04 now) with three network cards. By connecting unit #1 and #2 to two of the network cards (eth0 and eth1) in the Linux machine and using bridge, I've got them communicating. My /etc/network/interfaces looks like:

# The loopback network interface
auto lo
iface lo inet loopback

# The external interface
auto eth3
iface eth3 inet static

# The bridge interface
auto br0
iface br0 inet manual
  bridge_ports eth0 eth1

This works, and by using tcpdump I've confirmed that the udp packets are arriving from #1 and are heading towards #2 at port 6000.

The next step I hope will work is to use iptables to clone all udp packets comming from going to port 6000 at #2. I'm not very familiar with iptables, but after reading on line and the manual I thought this would work:

iptables -A PREROUTING -t mangle -p udp -s --dport 6000 -j TEE --gateway

The rule is applied successfully, but it doesn't work. If I use tcpdump to monitor eth3 I don't see the packets there.

I'd like to grab this stream, work on it and send it out as a multicast on the .10.2 interface.

What am I doing wrong? Is there something I've misunderstood?

share|improve this question

The packets never reach eth3 as is the machine itself. Also the duplicated packets still have the destincation ip-address You need to TEE them to a machine in for example so that the duplicates actually get routed over eth3.

iptables -t mangle -A PREROUTING -p udp --dport 6000 -j TEE --gateway

Then you also need to DNAT them to, so you can read the stream on and send it out via multicasting.

Either on itself:

iptables -t nat -A PREROUTING -p udp -d --dport 6000 -j DNAT --to-destination

Or still on before the packets are leaving eth3:

iptables -t nat -A POSTROUTING -o eth3 -p udp -d --dport 6000 -j DNAT --to-destination
share|improve this answer
If I understand this correctly, what you've explained would send the packets to a different machine (.10.254). I would like to avoid this extra machine, and just do this internally on one machine. If I set the gateway to, would that work=? – Håkon K. Olafsen Feb 23 '13 at 8:52
The gateway is just a next hop the destination still remains and you are not able to DNAT the duplicated packets on the machine "teeing" them. So will not work either. – lsmooth Feb 23 '13 at 11:41
So I can't do what I'm trying to using just one machine. – Håkon K. Olafsen Feb 23 '13 at 12:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.