iptables intercept local traffic

Question

I hope someone can help me out with a somewhat simple task.

I'm trying to redirect a client in my router through my desktop PC, so I can dump the traffic and analyze it (its potential source of poisoning the network with malicious packets).

The problem is that I don't have a second NIC on my hands and I was hoping I could redirect all the traffic from that IP through my PC, in essence performing a MiTM attack for the client. Does anyone have any idea where to start?

Current state:

(localip) --> (router) --> (internet)

And what i want to do:

(localip) --> (pc) --> (router) --> (internet)

IMHO the the fastest and cheapest solution is to buy a 2nd NIC in the nearest supermarket. — , Sep 15 '12 at 16:15

score 4 · Answer 1 · edited Oct 06 '12 at 00:09

4

A 2nd NIC turned out to be the easiest way, as the iptables on my router seems too limited. The MiTM attack worked, but I missed a lot of packets, and in the end it wasn't as reliable as dumping the traffic directly from the NIC.

Thank you all for the answers.

edited Oct 06 '12 at 00:09

HopelessN00b

53,795
33
135
209

answered Sep 22 '12 at 08:34

Anonymous

161
3

score 2 · Answer 2 · answered Sep 15 '12 at 17:09

Have you tried making your PC the default gateway for the client? You may need a rule on the router to route traffic for the client to the PC. Your PC will need to route traffic for the client, and be configured to routeback out the existing NIC.

From your question it appears your PC is running Linux, so you can use Shorewall to configure iptables on the PC. You can then capture traffic as you wish.

score 1 · Answer 3 · answered Sep 15 '12 at 14:35

1

You can do this with a tool like ettercap. It works using ARP poisoning. So, your PC will become the default gateway of the client machine and your machine can forward the traffic to the original router.

answered Sep 15 '12 at 14:35

Khaled

36,533
8
72
99

I can easily do that, but the problem is that not all traffic can be captured and in my tests more than 50% of the traffic is not redirected. Is there another solution? – Anonymous Sep 15 '12 at 14:55

iptables intercept local traffic

3 Answers3