| More

Objective: to copy/send or tee packets coming from enp3s4f1 and send to a destination IP via the enp3s4f0 management/data port
ServerA = enp3s4f1 (connected to a switch1 span port) (no IP address)
enp3s4f0  (connected to switch2 as management/data port)
(IP is
ServerB destination IP =  (same IP range)

This is based on commer’s post in LQ below:


  1. Configure  the bridge interface and bind enp3s4f1  into it. Disable Spanning Tree Protocol (STP) if necessary. Bring up the bridge interface

#brctl addbr br0
#brctl stp br0 off
# brctl addif br0 enp3s4f1
#ifconfig br0 up

2. Use ebtables to redirect the mac addresses of incoming packets to machine’s physical device

#ebtables -t broute -A BROUTING -i enp3s4f1 -j redirect –redirect-target DROP

3. Configure static route all expected incoming IP address/subnets

#ip route add dev enp3s4f1
#ip route add dev enp3s4f1

4. Tee the packets (sample filter DCHP packets) and send to

#iptables -t mangle -A PREROUTING -i enp3s4f1 -p udp –dport 67:68 –sport 67:68 ! -d -j TEE –gateway

Note: I configured exceptions on the same destination IP range to avoid double tee
use the command “iptables -t mangle -L -v” to see if tee packets are incrementing

Tested working using CentOS 7

3 Responses to “copy and send (tee) packets from a mirrored interface using iptables and ebtables”

  1. suresh

    on February 8 2018

    I have new requirement using the iptables/ebtables

    1. Receiving multicast stream with on
    an eth0 interface.

    2. Now i want forward the same stream( to diff interfaces eth1 , eth2.

    3. Please suggest your inputs

  2. Minnie

    on February 10 2019

    Nice post. I lean something totally new and challenging on websites I stumbleupon on a daily basis.

    It will always be exciting to read through content
    from other authors and practikce sometyhing from other sites.

  3. Sukumar Genji

    on December 30 2019

    Good Info.
    Same procedure works on CentOS 7 VM? I am trying the same but I see only broadcast packets hitting iptables rule(step#4), tcp/udp packets destined to specific IPs are not forwarded.
    Can anyone help me on this?

Comment RSS · TrackBack URI

Leave a comment

Name: (Required)

E-mail: (Required)




About FLT

This site is dedicated to everyone who likes to learn and explore the beautiful world of Linux. If you have comments and suggestions, please feel free to email at freelinuxtutorials@gmail.com. I am happy to serve and share things esp. that is free and enjoyable as Linux.