title: Emulate promiscuous mode with iptables
body: <p>I am trying to run snort on my home network but I don't have a switch that will mirror a port. Instead I have an Asus RT-N16 with Tomato (dd-wrt) on it. After hours of searching the only solution I found was here: <a href="http://www.snort.org/assets/182/snort-opensuse-vbox-ddwrt.txt" rel="nofollow">http://www.snort.org/assets/182/snort-opensuse-vbox-ddwrt.txt</a></p>
  
  <p>Basically they said to create these two iptables rules:</p>
  
  <p><strong>iptables -A PREROUTING -t mangle -j ROUTE --gw 192.168.1.20 --tee</strong></p>
  
  <p><strong>iptables -A POSTROUTING -t mangle -j ROUTE --gw 192.168.1.20 --tee</strong></p>
  
  <p>The problem is that --gw isn't a valid flag.</p>
  
  <p>Then I need to create a script that will check to see if the rule exists. If it does, delete the rule. If it doesn't, create the rule.</p>
  
  <p>Should I grep <strong>iptables -L -v -n --line-n</strong> or should I grep <strong>iptables-save</strong>?</p>
  
  <ol>
  <li><p>What would the correct iptables syntax be to emulate a promiscuous port to 192.168.1.20?</p></li>
  <li><p>How can I create the script that will turn on the iptables rules if they don't exsit, and delete them if they do?</p></li>
  </ol>
  
  <p>Thanks,</p>
  
  <p>Ryan</p>