How do you duplicate all UDP traffic on a port range using nftables

Question

I'm trying to get all traffic on port 8000-8900/udp to be copied to another port range, or another virtual device for measuring latency between multiple sources.

I'm aware iptables has a TEE option, however the examples I've found haven't worked for me.

Answer 1

A solution is to create another destination address to duplicate packets to.

sudo ip addr add 10.0.0.1/24 dev lo

In this example, we match udp packets coming on ports 8000 to 8100 from any non-loopback interface to avoid an infinite packet cycle. The packets duplicated and forwarded to the interface that routes to 10.0.0.1. Note that the packets have not been modified at this point, and still retain the original source and destination addresses.

Afterwards, we filter separately filter any packets on the loopback interface and set the destination ip address to itself, so debugging tools can listen on 10.0.0.1:8000-8100 and receive the packets.

#!/usr/sbin/nft -f

table ip mangle {
    chain prerouting {
        type filter hook prerouting priority mangle; policy accept;
        iifname != lo udp dport 8000-8100 dup to 10.0.0.1 device lo notrack
    }

    chain input {
        type filter hook input priority mangle; policy accept;
        iifname lo udp dport 8000-8100 ip daddr set 10.0.0.1 notrack
    }
}

Example command to listen to packets: nc -v -k -u -l 10.0.0.1 8000

To clean up, run

sudo ip addr delete 10.0.0.1/24 dev lo
sudo nft flush ruleset

In the screenshot, host 192.168.1.50 sends a packet to 192.168.1.2:8000, and it is duplicated. The application on 192.168.1.2:8000 responded to the sender. Note that wireshark does not show the updated destination address.