Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1):

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:3000

Then tcpdump is set up to record all traffic at the lo interface:

tcpdump -i lo -w output.dump

However, after I sent some internet traffic (port 80) through eth1, this traffic is not recorded by tcpdump.

I am not sure why this is so. Can someone please shed some light? Thanks.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

As you are rewriting the IP packet destination to one of the local host's addresses, it is not passed through the interface the address belongs to (lo in your case) but is simply handled by the stack directly. Thus, you cannot capture it by listening at the loopback interface. This would not be any different if you picked any physically present interface's address.

If you need to capture the conversation, I'd suggest using an appropriate filter expression. Something along the lines of

tcpdump -i lo -i eth1 host 127.0.0.1 or port 3000

should do what you want.

share|improve this answer
    
Thanks for explaining. There also seems to be another problem with my query. I was redirecting from an external ip to localhost (127.0.0.1) and somehow this is not allowed by the linux kernel. So after I switched the target ip from localhost to another address, the packet successfully reached there. However, tcpdump also did not pick up the arriving traffic, which further confirms what you wrote. –  tonytz Apr 26 '13 at 4:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.