I know there's some topics about forcing local IP trafic of a Linux machine to go through the LAN (over the network where a WireShark is captuting trafic) but all solutions implies IP address modification.

Now my setup :

  • A Linux PC with ONE interface with two IPs : (eth0:0) and (eth0:1)
  • A server that listen on
  • A client (bind on that connect to

My question is : Is it possible to force Linux Kernel to let the IP packets go throuh the network (a switch + a PC with Wireshark) WITHOUT changing IP address and ports so WireShark will see and as src and destination (and vice versa) ?

Like I said I found some answers with IP changes here: Force local TCP packets over network segment for capture and another one here : Force local IP traffic to an external interface

Maybe it's impossible at all without driver or kernel modification ? I'm a C programmer so if I have to seek in kernel modifications it may be a possible solution.


After some investigations :

I found a possible solution with a sysctl parameter : accept_local in combination with rp_filter : "Accept packets with local source addresses. In combination with suitable routing, this can be used to direct packets between two local interfaces over the wire and have them accepted properly." I'll give it a try and let you know if it's working with only ONE interface and virtuals IP

I tried with many routing tables alternatives but i think that it's impossible on one interface..

1 Answer 1


If you are on Linux you can packet capture on the lo (loopback) interface. There is no need to force the traffic onto the wire.

  • Thanks for comment, i'm aware of that but there's some users on the lan who want to capture packets (not me) so i have to let the traffic go through wires.
    – Pigmin
    Jul 10, 2015 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .