iptables port-mirroring

Question

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined.

sudo iptables -t nat -A PREROUTING -p TCP -s 127.0.0.1 --sport 8001 -j DNAT --to-destination 127.0.0.1:8002 --tee

Answer 1

The --tee flag is not part of the DNAT chain, it is part of ROUTE. You can only use it following a declaration of -j ROUTE. You can get specific help from iptables on the subject like this:

 $ iptables -j ROUTE help

I was looking at your iptables command, and it doesn't make any sense to me. Why are you trying to match against the source and source port of a packet when in your question you said "packegs received on port"? Are you trying to split incoming traffic to hit two ports or take the output of one port and tie it to the input of another?

If the former, there are really two steps. You can't use tee to get a copy of the packet AND mangle the packet to change the port numbers at the same time. You might try this in two steps, first sending yourself a duplicate copy of the packet, then matching the copy only and mangling the destination port. WARNING: untested, consider this pseudo-code:

$ sudo iptables -A PREROUTING -t mangle -p tcp -s !172.0.0.1/32--dport 8001 -j ROUTE --gw 127.0.0.1 --tee
$ sudo iptables -A POSTROUTING -t nat -p tcp -s 127.0.0.1/32 --dport 8001 -j DNAT --to 127.0.0.1:8002