3

I know there's some topics about forcing local IP trafic of a Linux machine to go through the LAN (over the network where a WireShark is captuting trafic) but all solutions implies IP address modification.

Now my setup :

  • A Linux PC with ONE interface with two IPs : 192.168.1.2 (eth0:0) and 192.168.1.3 (eth0:1)
  • A server that listen on 192.168.1.2
  • A client (bind on 192.168.1.3) that connect to 192.168.1.2

My question is : Is it possible to force Linux Kernel to let the IP packets go throuh the network (a switch + a PC with Wireshark) WITHOUT changing IP address and ports so WireShark will see 192.168.1.2 and 192.168.1.3 as src and destination (and vice versa) ?

Like I said I found some answers with IP changes here: Force local TCP packets over network segment for capture and another one here : Force local IP traffic to an external interface

Maybe it's impossible at all without driver or kernel modification ? I'm a C programmer so if I have to seek in kernel modifications it may be a possible solution.

-

After some investigations :

I found a possible solution with a sysctl parameter : accept_local in combination with rp_filter : "Accept packets with local source addresses. In combination with suitable routing, this can be used to direct packets between two local interfaces over the wire and have them accepted properly." I'll give it a try and let you know if it's working with only ONE interface and virtuals IP

I tried with many routing tables alternatives but i think that it's impossible on one interface..

0

If you are on Linux you can packet capture on the lo (loopback) interface. There is no need to force the traffic onto the wire.

  • Thanks for comment, i'm aware of that but there's some users on the lan who want to capture packets (not me) so i have to let the traffic go through wires. – Pigmin Jul 10 '15 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.