IPTables kung-foo
Discussion
Say I've got a netgear router running linux I can telnet to, and is running IPTables. Can I get it to copy/forward packets that match certain criteria (i.e. dest. port) to another address for later perusal? What would be the easiest way of acomplishing such a feat?
I was thinking at the receiving end just get the receiving router to fire the packets at a random address on the LAN and get ethereal to pick them off the wire, but I don't know how to go about getting IPtables to copy AND reroute them in the first place, cause iptables docs make my head explode
I was thinking at the receiving end just get the receiving router to fire the packets at a random address on the LAN and get ethereal to pick them off the wire, but I don't know how to go about getting IPtables to copy AND reroute them in the first place, cause iptables docs make my head explode
aldi said:
Say I've got a netgear router running linux I can telnet to, and is running IPTables. Can I get it to copy/forward packets that match certain criteria (i.e. dest. port) to another address for later perusal? What would be the easiest way of acomplishing such a feat?
I was thinking at the receiving end just get the receiving router to fire the packets at a random address on the LAN and get ethereal to pick them off the wire, but I don't know how to go about getting IPtables to copy AND reroute them in the first place, cause iptables docs make my head explode
I was thinking at the receiving end just get the receiving router to fire the packets at a random address on the LAN and get ethereal to pick them off the wire, but I don't know how to go about getting IPtables to copy AND reroute them in the first place, cause iptables docs make my head explode
So, basically you want to say send incomming port 80 requests to BOTH 192.168.0.1 and 192.168.0.2? But not have .2 as a live machine just some form of data buffer?
I'm not sure it can, to be honest the first thing that springs to mind is a custom TCP/IP stack but that's way beyond my abilities to create.
ThePassenger said:
So, basically you want to say send incomming port 80 requests to BOTH 192.168.0.1 and 192.168.0.2? But not have .2 as a live machine just some form of data buffer?
I'm not sure it can, to be honest the first thing that springs to mind is a custom TCP/IP stack but that's way beyond my abilities to create.
I'm not sure it can, to be honest the first thing that springs to mind is a custom TCP/IP stack but that's way beyond my abilities to create.
Yes thats the puppy, I just want to copy the network traffic basically so I can inspect it later, without touching the target box in any way. Looks like I'l have to go down there and set something up locally... Cheers!
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff