Duplicating packets

From nftables wiki
Jump to: navigation, search

Since Linux kernel 4.3, you can duplicate packets to another IPv4 or IPv6 destination address. You may want to use this feature to copy selected traffic from the local system to a remote host for further inspection.

The following rule duplicates all traffic to

% nft add rule mangle prerouting dup to

You can also force the dup statement to use a given device to route traffic from:

% nft add rule mangle prerouting dup to device eth1

The above rule specifies that the duplicated packets must leave the system via interface eth1. Your system must have a route to reach via eth1 for this to work.

You can also combine the dup statement with maps. For example:

% nft add rule mangle prerouting dup to ip saddr map { :, : }

This rule send duplicated packets to different remote hosts, depending on the source IPv4 address.