tcpdump not picking up traffic redirected by iptables

Question

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1):

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:3000

Then tcpdump is set up to record all traffic at the lo interface:

tcpdump -i lo -w output.dump

However, after I sent some internet traffic (port 80) through eth1, this traffic is not recorded by tcpdump.

I am not sure why this is so. Can someone please shed some light? Thanks.

Solution

As you are rewriting the IP packet destination to one of the local host's addresses, it is not passed through the interface the address belongs to (lo in your case) but is simply handled by the stack directly. Thus, you cannot capture it by listening at the loopback interface. This would not be any different if you picked any physically present interface's address.

If you need to capture the conversation, I'd suggest using an appropriate filter expression. Something along the lines of

tcpdump -i lo -i eth1 host 127.0.0.1 or port 3000

should do what you want.

Comments

[damerica]

Thanks for explaining. There also seems to be another problem with my query. I was redirecting from an external ip to localhost (127.0.0.1) and somehow this is not allowed by the linux kernel. So after I switched the target ip from localhost to another address, the packet successfully reached there. However, tcpdump also did not pick up the arriving traffic, which further confirms what you wrote.