I'm trying to get all traffic on port 8000-8900/udp to be copied to another port range, or another virtual device for measuring latency between multiple sources.

I'm aware iptables has a TEE option, however the examples I've found haven't worked for me.

1 Answer 1


A solution is to create another destination address to duplicate packets to.

sudo ip addr add dev lo

In this example, we match udp packets coming on ports 8000 to 8100 from any non-loopback interface to avoid an infinite packet cycle. The packets duplicated and forwarded to the interface that routes to Note that the packets have not been modified at this point, and still retain the original source and destination addresses.

Afterwards, we filter separately filter any packets on the loopback interface and set the destination ip address to itself, so debugging tools can listen on and receive the packets.

#!/usr/sbin/nft -f

table ip mangle {
    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        iifname != lo udp dport 8000-8100 dup to device lo notrack

    chain input {
        type filter hook input priority mangle; policy accept;
        iifname lo udp dport 8000-8100 ip daddr set notrack

Example command to listen to packets: nc -v -k -u -l 8000

To clean up, run

sudo ip addr delete dev lo
sudo nft flush ruleset

In the screenshot, host sends a packet to, and it is duplicated. The application on responded to the sender. Note that wireshark does not show the updated destination address.

Wireshark log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.