Port Mirroring using iptables - copy all traffic among nginx on :80 and apache on :8080

Question

I have nginx running on port 80 and apache running on port 8080

I want to transfer all the traffic to both nginx and apache asynchronously i.e the performance of one server wont be dependent on the others. The reason being nginx will serve my website and apache will be used to run analytics on the traffic.

I tried the solution mentioned in the question below

iptables port-mirroring

sudo iptables -A PREROUTING -t mangle -p tcp ! -s 127.0.0.1/32 --dport 80 -j TEE --gateway 127.0.0.1

and

sudo iptables -A POSTROUTING -t nat -p tcp -s 127.0.0.1/32 --dport 8080 -j SNAT --to 127.0.0.1:8080

The solution mentions using DNAT with POSTROUTING on NAT table but it is not allowed to do that. DNAT is only allowed on PREROUTING/OUTPUT.

I am using iptables v1.4.10 on ubuntu 11.04

Answer 1

I am struggling to see how this could work in practice. The usual use of port mirroring is to monitor the packets going via a particular interface without actively taking part in the network protocol.

Passing the TCP packets to applications on port 80 and 8080 requires the there are two target TCP endpoints talking back to a single source TCP endpoint. This can only end in failure. Even if you could arrange that the SYN, ACK and other values were synchronised between tcp stacks on both 80 and 8080 then the applications will still produce output and hence the requestor would get double data back.

If you do want to use port mirroring then you need to use an application that does low level packet analysis. Alternatively you likely need to do some form of web access.log analysis to analyse your traffic being served by nginx.