0

I am trying to setup udp packet duplication. Usecase will be syslog messages. These messages are beeing sent to machine A ( xxx.xxx.xxx.177 : 5140 , debian 10). They are received by a service. With nftables I wanted to also send these packets to machine B (xxx.xxx.xxx.156 : 5140 , Win Server 2016).

What I tried is:

table ip sysTable { # handle 6
        chain sysChain { # handle 1
                type filter hook prerouting priority -300; policy accept;
                udp dport 5140 counter packets 4 bytes 131 dup to xxx.xxx.xxx.156 # handle 2
        }
}

Via netcat I am creating udp-messages from machine A to machine A. These messages are received by my application and also the nftable counter is increasing. tcpdump on box A shows the packets aswell

tcpdump udp port 5140 

>>> 21:56:23.018877 IP xxx.xxx.xxx.177.12345 > xxx.xxx.xxx.177.5140: UDP, length 4

But nothing happens on box B. An UDP-Listener on Port 5140 shows nothing. A direct netcat from A to B works. Also tcpdump does not show the duplicate packet hopefully created by nftables.

I did not find many examples using nft dup in context with a specific port.

With friendly regards

Marc

Improve this question
1
  • The destination gateway (check the table/chart in the man page) is only used (in case of usual Ethernet) to resolve the Ethernet MAC address of the target via ARP: it also has to be in the same LAN. The IP address won't change and will still be the system A's IP (since it was the initial destination) which is most likely then ignored by system B. Having to tweak Windows won't be answered on UL SE. Maybe you can give more background on your problem. – A.B Nov 13 '20 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.