I configured one port of my switch to do port mirroring of the other ports. I connected to this port mirroring a server where iptables has some rules. If some rules are matched, iptables sends to the log.
My problem is that iptables does not detect anything. My rules are quiet simple, they are like :
iptables -N BAD-IP iptables -A BAD-IP -j LOG --log-prefix 'BAD-IP ' --log-level 4 iptables -A BAD-IP -j ACCEPT
iptables -I FORWARD -d xxx.xxx.xxx.xxx -j BAD-IP
I tried with INPUT, also with OUTPUT, no detection I also tried with eth0 promisc, no detection
What's wrong? How will I be re-use my rules for this architecture? Thanks for your help