3

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1):

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:3000

Then tcpdump is set up to record all traffic at the lo interface:

tcpdump -i lo -w output.dump

However, after I sent some internet traffic (port 80) through eth1, this traffic is not recorded by tcpdump.

I am not sure why this is so. Can someone please shed some light? Thanks.

Improve this question

1 Answer 1

Reset to default
4

As you are rewriting the IP packet destination to one of the local host's addresses, it is not passed through the interface the address belongs to (lo in your case) but is simply handled by the stack directly. Thus, you cannot capture it by listening at the loopback interface. This would not be any different if you picked any physically present interface's address.

If you need to capture the conversation, I'd suggest using an appropriate filter expression. Something along the lines of

tcpdump -i lo -i eth1 host 127.0.0.1 or port 3000

should do what you want.

Improve this answer
1
  • Thanks for explaining. There also seems to be another problem with my query. I was redirecting from an external ip to localhost (127.0.0.1) and somehow this is not allowed by the linux kernel. So after I switched the target ip from localhost to another address, the packet successfully reached there. However, tcpdump also did not pick up the arriving traffic, which further confirms what you wrote.
    – tonytz
    Apr 26, 2013 at 4:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.