[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Traffic Mirroring for Debugging


In one of our servers, I want to debug a network server daemon. The
problem is I don't have luxury for a downtime or to iterrupt related
server's network traffic. Current routing structure looks like below.

  VPN Switch ( -> Server Machine (

To debug the related server daemon, I planned to redirect the network
traffic to a second sandbox server. Planned routing structure is:

  VPN Switch (
  +-> Temporary Linux Machine (
      |+-> Server Machine (
      +--> Sandbox Server Machine (

For test purposes, I configured a client to connect to
(instead of actual server, But I couldn't manage to
redirect incoming traffic of to and machines. How can I get such a mirrored redirection?

Furthermore, I first considered using DNAT of iptables, but learnt that
it doesn't support multiple destinations without load-balancing. Anyway,
I wanted to give it a try for just a single machine. I connected to 1.10
machine and typed below iptables command:

  # iptables -t nat -A PREROUTING -d -j DNAT --to-destination
  # iptables -L -n -t nat
  Chain PREROUTING (policy ACCEPT)
  target     prot opt source               destination
  DNAT       0    --   to:

  target     prot opt source               destination

  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination

And started a netcat listener on 1.20 machine:

  # nc -l -p 2310

Then tried to connect to the started nc listener from 1.10 machine:

  # nc -vvv 2310 inverse host lookup failed: Unknown host
  (UNKNOWN) [] 2310 (?) : Connection refused
   sent 0, rcvd 0

Gosh! Even couldn't manage to make DNAT for a single address work
properly. Any helps will be really really appreciated.


Reply to: