IPTABLES MIRROR Target

[steve.milner]

Some time ago the MIRROR target was dropped from iptables.

I know this was done for good security reasons.

However, I'd like to understand if this is still possible with the current iptables.

What is required is to take all packets sent from address x.x.x.x to y.y.y.y and swap the source and destination addresses of the packet and then allow the packet to return to the sender.

My knowledge of iptables isn't good enough to work out how to do this and despite much reading of how-tos etc I'm little the wiser.

Could anyone supply me with the relevant iptables command required to implement this so that I can then try to understand how this works.

Regards,
Steve

[caveman8fb]

You could try having snort listen for something from x.x.x.x to y.y.y.y then write an alert to a log file only used by this rule. Have logwatch or some custom script check that log every second, then re-writes the packet swapping the source and destination in the header with an ip spoofing tool such as hunt.