0

I'm trying to use iptables.

I'm simulating a network with Mininet. I currently have a router connecting two subnets (10.0.1.1/24 and 10.0.2.1/24). If I use these two iptables rules on the router I see that two duplicates are created, but on the host 10.0.2.180 I only see echo request or reply packets (in the case of icmp ping). It seems that it is not bidirectional. The router only captures traffic traveling from one subnet to another, not internal traffic.

I wrote this two rules on the router, but I can only catch inbound traffic. I would also need to take the outgoing traffic. I'm using this iptables rules:

iptables -t mangle -A PREROUTING -i r1-eth1 -j TEE --gateway 10.0.2.180

iptables -t mangle -A POSTROUTING -o r1-eth1 -j TEE --gateway 10.0.2.180
2
  • You could try iptables -t mangle -A POSTROUTING -o r1-eth1 -j TEE --gateway 10.0.2.180 Dec 7, 2022 at 23:49
  • Please add details to your question, not in comments Dec 12, 2022 at 0:06

1 Answer 1

0

The router only captures traffic traveling from one subnet to another, not internal traffic

Modern ethernet networks are mostly point-to-point so you will see only broadcast traffic and traffic that is directed to (through) your router. You may be able to see a little more than usual by setting the interface into "promiscuous" mode,

ip link set r1-eth1 promisc on

but devices such as switches intentionally avoid transmitting traffic through links that don't need it. You can cheat the system with an ARP poisoning attack such as can be implemented with arpspoof, but if you're going to do that you may find that you don't need to TEE the packets and instead you can just route the originals via the monitoring device.

2
  • I see no change by setting the router or switch promiscuous interface. Everything seems the same to me as before. However I need to duplicate both incoming and outgoing packets of the router. It's not enough for me to just pipe them elsewhere, so I need to use the --tee option.
    – Luigis94
    Dec 17, 2022 at 12:33
  • You can only tee traffic that needs to go through the router. As I've already explained you won't see most other traffic on the network. Dec 17, 2022 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .