Clone a packet - iptables

Clone a packet - iptables

[Piotr Szczap]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,
Is it possible to 'clone' a packet using iptables?
I would like to do something like
- -A INPUT -p tcp --dport 1111 -j DNAT --to-destination host_a
- --to-destination host_b
but without the round-robin load balancing, so that the packet coming to
port 1111 is sent to host_a AND host_b.

Or perhaps it can be done with BSD's packet filter?

- --
Piotr Szczap
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFEOmuyQtNF0qNPlOERAj4mAJ9oNGvHvFRIcLjOztrpA90hUQT9CgCfQEZB
Wqern5KavSpSzQcV7+y9ihA=
=79wV
-----END PGP SIGNATURE-----

Re: Clone a packet - iptables

[Martin Klier]

[-- Attachment #1: Type: text/plain, Size: 900 bytes --]

Hi,

Am Montag 10 April 2006 16:29 schrieb Piotr Szczap:
> Hello,
> Is it possible to 'clone' a packet using iptables?
> I would like to do something like
> -A INPUT -p tcp --dport 1111 -j DNAT --to-destination host_a
> --to-destination host_b
> but without the round-robin load balancing, so that the packet coming to
> port 1111 is sent to host_a AND host_b.
>
> Or perhaps it can be done with BSD's packet filter?

I bet Linux' netfilter can't do this. Think about your tcp connection's 
partner: it will receive ACK flags from two processes on the destination 
machine. Your tcp connection won't survive for long.

Kind regards,
-- 
Mit freundlichen Grüßen

i.A. Martin Klier
Systemadministration / Datenbanken
-----------------------------------------------------------------
A.T.U Auto-Teile-Unger
Handels GmbH & Co. KG
Dr.-Kilian-Straße 4
D-92637 Weiden i. d. OPf.

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Clone a packet - iptables

[Piotr Szczap]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin Klier wrote:
> 
> I bet Linux' netfilter can't do this. Think about your tcp connection's 
> partner: it will receive ACK flags from two processes on the destination 
> machine. Your tcp connection won't survive for long.

You're right ofcourse but I made a mistake in my question:
I want to clone UDP not TCP. Does this change anything?


Regards,
Piotr Szczap
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFEO3MzQtNF0qNPlOERAqsUAJ99eZ/kkVRPgDrjmHg/wea2+EF0DwCfZAAC
/0bDZzqmNLIM577ZMXglmtk=
=R/iQ
-----END PGP SIGNATURE-----

Re: Clone a packet - iptables

[Tom Callahan]

If I remember correctly.....won't the sequence numbers be out of whack 
due to multiple transactions? Would this result in corrupted data? Or a  
dropped connection?

Tom Callahan
TESSCO Technologies
Desk: (410)-229-1361
Cell: (410)-588-7605
Email: callahant@tessco.com

A real engineer only resorts to documentation when the keyboard dents on the forehead get too noticeable.



Piotr Szczap wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Martin Klier wrote:
>  
>
>>I bet Linux' netfilter can't do this. Think about your tcp
>>    
>>
>connection's 
>  
>
>>partner: it will receive ACK flags from two processes on the
>>    
>>
>destination 
>  
>
>>machine. Your tcp connection won't survive for long.
>>    
>>
>
>You're right ofcourse but I made a mistake in my question:
>I want to clone UDP not TCP. Does this change anything?
>
>
>Regards,
>Piotr Szczap
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.7 (GNU/Linux)
>Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
>iD8DBQFEO3MzQtNF0qNPlOERAqsUAJ99eZ/kkVRPgDrjmHg/wea2+EF0DwCfZAAC
>/0bDZzqmNLIM577ZMXglmtk=
>=R/iQ
>-----END PGP SIGNATURE-----
>-
>To unsubscribe from this list: send the line "unsubscribe linux-admin"
>in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html
>  
>

Re: Clone a packet - iptables

[Andy Davidson]

Piotr Szczap wrote:
> You're right ofcourse but I made a mistake in my question:
> I want to clone UDP not TCP. Does this change anything?

If you are wanting this for monitoring/debugging/IDS, etc. you are much 
better off with a monitoring port on your switch..

cheers
-a