Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 10 machine web cluster with approximately 1500 req/seq.

How can we copy/clone all user traffic that comes to this production cluster in order to test new version of software, which is installed on a little bit smaller test cluster?

It should be copy, not load balancing, i.e. real users must receive answer from production cluster, not testing one.

OS: Linux


share|improve this question
up vote 1 down vote accepted

I believe what you are looking for is a switch which has port mirroring.

From Wikipedia - Port Mirroring:

Port Mirroring is used on a network switch to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic, such as an intrusion-detection system. Port mirroring on a Cisco Systems switch is generally referred to as Switched Port Analyzer (SPAN); some other vendors have other names for it, such as Roving Analysis Port (RAP) on 3Com switches.

share|improve this answer
Great! Is there any way to do the same via software? Linux for example. – Marko Kevac May 4 '10 at 10:46
this is too low-level. you would nee to solve too many layers, if you are only interested in HTTP traffic cloning. – mighq Mar 11 at 14:02

You can easily achieve what you want with Parallel Proxy (

Note: I am one of the owners of Parallel Proxy.

Parallel Proxy allows you to send the same requests to a production and test server. Only the production responses are sent back to clients and both sets of responses are logged for analysis. The analysis tools provided easily allow you to find and classify differences in the responses of the servers, allowing you to identify and fix problems with your test server before it is deployed in your production environment.

share|improve this answer

I have never tried this in this context, but you can replay wirehshark/tcpdump capture files (pcap). tcp replay would do this. So you can capture the traffic of a production server and then replay it against the test server if you feel you must capture tests of 'wrong network packets etc'.` I don't know if this really simulates the traffic though as any sort of session traffic (web based or tcp) would need to be maintained and the packets properly altered (For example, TCP initial sequence numbers, ACK synchronization etc).

I still think a testing framework that will run scripts like jmeter makes the most sense though (You could have them inject 'hacker-like-stuff' into the fields in the webpage if you feel you must). Then at the same time you can launch your own DoS and malformed packets with a crafting tool such as scapy (scapy isn't fast, so not the ideal tool for the DoS part). A good firewall should be handling the DoS/Malformed Packets part before it gets to the server anyways, so normally I would say these are two different tests.

share|improve this answer

YOu sort of can not. That said, every web testing framework will allow you to set up scripts that simulate user and test them through that - including unit and larger functional testing.

share|improve this answer
But web testing framework will not try to hack us, will not send wrong network packets, will not do a lot more things that real users do every day. – Marko Kevac Apr 19 '10 at 11:38
If it's what real users are doing every day, isn't it part of what can be scripted or simulated to test for error conditions and error handling, as well as scanning with things like Nessus or Saint? I thought you can't completely test that the software is free of bugs, just confirm that it has them? (Maybe I'm misremembering that though.) – Bart Silverstrim Apr 19 '10 at 13:00
Actually specifi technologies allow you to do things like hitting functions with random or assumed tricky (after code analysis) parameters to make sure you handle all bugs ;) THere is quite some stuff around - though most is still in labs. – TomTom Apr 19 '10 at 13:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.