Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I configured one port of my switch to do port mirroring of the other ports. I connected to this port mirroring a server where iptables has some rules. If some rules are matched, iptables sends to the log.

My problem is that iptables does not detect anything. My rules are quiet simple, they are like :

iptables -N BAD-IP iptables -A BAD-IP -j LOG --log-prefix 'BAD-IP ' --log-level 4 iptables -A BAD-IP -j ACCEPT

iptables -I FORWARD -d xxx.xxx.xxx.xxx -j BAD-IP

I tried with INPUT, also with OUTPUT, no detection I also tried with eth0 promisc, no detection

What's wrong? How will I be re-use my rules for this architecture? Thanks for your help

share|improve this question
    
Is the server receiving the packets? check with tcpdump -v src BAD-IP –  GeoSword Nov 21 '13 at 17:21
    
are you sure there is no rule above the log line which is rejecting or jumping you to another chain? I think post your iptables config –  Petter H Nov 21 '13 at 17:48
    
no, sure, because when i configure this server as a gateway, all my rules are matched. I have problem to understand why iptables doesn't match anything but when i install tshark, it is seeing. The main problem, that i have some iptables rules that i cannot export to tcpdump or tshark. The only detail, that I am obligate to work on port mirroring, and see if I match some trafic with my 5000 iptables rules. I already modify rules to proceed to LOG&ACCEPT. I may modify by INPUT, OUTPUT, FORWARD but nothing seem to be matched. –  marco Nov 21 '13 at 18:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.