Mirroring with iptables TEE - some help?

[Emphyrio]

Hi all! I'm trying to mirror data sent from a Bresser weather station to a WeeWX install (so I can intercept the data sent to rtupdate.wunderground.com). Unfortunately failing to get results Can you help?

Running these commands on AsusWrt (RT-AC68U on Merlin 384.11_2):

modprobe xt_TEE
iptables -t mangle -A PREROUTING -s 192.168.1.31 -j TEE --gateway 192.168.1.27
iptables -t mangle -A POSTROUTING -d 192.168.1.31 -j TEE --gateway 192.168.1.27​

Then running this command at the Weewx install (192.168.1.27):

tcpdump -nnSX port 80​

Is listening but not showing any output... I was hoping to see some traffic but nothing. What can I try?

P.S. The weather station @ 192.168.1.31 is succesfully transmitting to weatherunderground.com, so that prerequisite has been provided for I believe.

 

[dave14305]

Hi all! I'm trying to mirror data sent from a Bresser weather station to a WeeWX install (so I can intercept the data sent to rtupdate.wunderground.com). Unfortunately failing to get results Can you help?

Running these commands on AsusWrt (RT-AC68U on Merlin 384.11_2):

modprobe xt_TEE
iptables -t mangle -A PREROUTING -s 192.168.1.31 -j TEE --gateway 192.168.1.27
iptables -t mangle -A POSTROUTING -d 192.168.1.31 -j TEE --gateway 192.168.1.27​

Then running this command at the Weewx install (192.168.1.27):

tcpdump -nnSX port 80​

Is listening but not showing any output... I was hoping to see some traffic but nothing. What can I try?

P.S. The weather station @ 192.168.1.31 is succesfully transmitting to weatherunderground.com, so that prerequisite has been provided for I believe.

I don’t know anything about TEEing, but are you certain the data is only transferred on port 80 for your tcpdump? What about 443?

Edit: I guess you couldn’t intercept encrypted data, but maybe a different port nonetheless?

 

[dave14305]

Hi all! I'm trying to mirror data sent from a Bresser weather station to a WeeWX install (so I can intercept the data sent to rtupdate.wunderground.com). Unfortunately failing to get results Can you help?

Running these commands on AsusWrt (RT-AC68U on Merlin 384.11_2):

modprobe xt_TEE
iptables -t mangle -A PREROUTING -s 192.168.1.31 -j TEE --gateway 192.168.1.27
iptables -t mangle -A POSTROUTING -d 192.168.1.31 -j TEE --gateway 192.168.1.27​

Then running this command at the Weewx install (192.168.1.27):

tcpdump -nnSX port 80​

Is listening but not showing any output... I was hoping to see some traffic but nothing. What can I try?

P.S. The weather station @ 192.168.1.31 is succesfully transmitting to weatherunderground.com, so that prerequisite has been provided for I believe.

Check the packets/bytes count on the router to see if the rule is matching.

iptables -t mangle -L -v

Should be greater than 0 for either of the rules with TEE.

 

[Emphyrio]

Thanks for your responses!

The weather station is supposed to output at port 80, but you're right better to verify. So I checked with tcpdump -i eth0 but no traffic from 192.168.31 (weather station) seems to be reaching 192.168.1.27 (weewx install). No luck there.

Below is the output for that command. Is this as expected?

iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 4571 packets, 664K bytes)
 pkts bytes target     prot opt in     out     source               destination
  214 10277 TEE        all  --  any    any     Bresser-base         anywhere             TEE gw:192.168.1.27

Chain INPUT (policy ACCEPT 2242 packets, 368K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 2319 packets, 295K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 2350 packets, 397K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 4666 packets, 693K bytes)
 pkts bytes target     prot opt in     out     source               destination
  278 11504 TEE        all  --  any    any     anywhere             Bresser-base         TEE gw:192.168.1.27

 

[dave14305]

Thanks for your responses!

The weather station is supposed to output at port 80, but you're right better to verify. So I checked with tcpdump -i eth0 but no traffic from 192.168.31 (weather station) seems to be reaching 192.168.1.27 (weewx install). No luck there.

Below is the output for that command. Is this as expected?

iptables -t mangle -L -v
Chain PREROUTING (policy ACCEPT 4571 packets, 664K bytes)
 pkts bytes target     prot opt in     out     source               destination
  214 10277 TEE        all  --  any    any     Bresser-base         anywhere             TEE gw:192.168.1.27

Chain INPUT (policy ACCEPT 2242 packets, 368K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 2319 packets, 295K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 2350 packets, 397K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 4666 packets, 693K bytes)
 pkts bytes target     prot opt in     out     source               destination
  278 11504 TEE        all  --  any    any     anywhere             Bresser-base         TEE gw:192.168.1.27

It at least shows that the rules are matching the traffic, but in small amounts. Maybe run the following on the router to see any traffic going to the weewx:

tcpdump -i br0 host 192.168.1.27

Maybe someone smarter than me can help to write a LOG statement for iptables to at least confirm what is going where. You might have better luck on the weewx sites where this seems to be "a thing".

 

[Emphyrio]

You might have better luck on the weewx sites where this seems to be "a thing".

Unfortunately, no one there is responding to my question
Thanks for your input!

 

[skeal]

Unfortunately, no one there is responding to my question
Thanks for your input!

I just purchased 4x8 port switches from Amazon for 45$ Canadian each. They have an option under switching called "Port Mirroring," I'm not sure if this is what you need but I thought I would pass the knowledge on.