0

Host C is using wireshark to sniff packets from Host A to Host B. I am able to see those packets from wireshark but I am not able to find them in the PREROUTING chain of iptables. When Host C arpspoofs Host A and B, I can then see the packets in my PREROUTING chain.

Without arpspoofing, those packets that I sniffed from A to B will appear in which chain of the iptables?

schroeder
  • 123,438
  • 55
  • 284
  • 319
Lew Wei Hao
  • 429
  • 5
  • 13

1 Answers1

0

Without ARP spoofing, the packets with an ethernet destination different from host C’s own address will not reach any chain of netfilter.

When you use wireshark, it sets the ethernet NIC in promiscuous mode, to see packets with other destinations, but they are still not handled by the kernel and netfilter.

user2233709
  • 540
  • 4
  • 12