iptables rule redirects all closed ports on the machine to the one portspoof listens to: https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229eafdaf69a818

iptables rule redirects all closed ports on the machine to the one portspoof listens to: https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229eafdaf69a818cc7a847ff3/system_files/iptables-config#L10 https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229e... Then it calls getsockopt to find out what the original port was: https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229eafdaf69a818cc7a847ff3/src/connection.cpp#L153 https://github.com/drk1wi/portspoof/blob/c3f3c34531c59df229e...