Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a C++ Program to sniff each and every packet that crosses my linux box. However i need to now get my linux box to listen to every traffic in my network. I could buy a managed switch and set up port spanning, but i aint paying 200+ £'s for a switch and plus gives me a chance to learn.

My Network

                                            +---------Computer A
                                            |
Internet-----Router------Switch-------------+---------Linux Box
                                            |
                                            +---------Computer B

Proposed Network

                                            +---------Computer A
                                            |
Internet-----Router------Linux Box--------Switch
                    eth0^         ^eth1     |
                                            +---------Computer B

How would i setup this in linux. Do i just configure both the ethernet on different IP Address on the same network. Or am i completelly on the wrong track

My System

  • Fedora 13.

Thanks

share|improve this question
8  
Bridge the interfaces... –  Chris S Jan 12 '11 at 15:36
    
I want to manually set this up. So bridging would mean bonding the two interfaces together. –  Sparky Jan 12 '11 at 15:48
    
I have tcpdump to sniff all traffic. Did you actually write your own? :O –  Tom O'Connor Jan 12 '11 at 15:50
    
Y'know.. You could buy a cheap hub (yes, hub) and then use that. Hubs just retransmit all traffic to all other interfaces. –  Tom O'Connor Jan 12 '11 at 15:51
    
@Tom, yea using libcapp, it was a freaking nightmare. Na i dont wana buy. I wana do :D –  Sparky Jan 12 '11 at 15:53
show 6 more comments

4 Answers

up vote 3 down vote accepted

I'm assuming your current network is on a private subnet and that your router performs NAT for external communication (i.e. to the outside world all your machines look to have the same IP address). You have two options here:

  1. set the machine up as a bridge
  2. set the machine up as a NAT router

To set it up as a router:

  • have eth0 setup as if it is a client to the current router
  • have eth1 on a different subnet
  • have the server configured to hand out addresses on this subnet to the other machines via DHCP
  • add the approptiate iptables rules so the box performs NAT for outgoing connections from the eth1 side
  • if you have any manual port forwarding setup on the router at the moment this will need to be set to point to the new box and the new box set to forward these connections further into the network

Exactly how you do some of the above perminantly (i.e. so it survives a reboot) depends on your Linux distribution and any other local network setup you need to respect. http://www.linuxjournal.com/article/8172 shows an example of a bridge setup using a RedHat/Fedora/CentOS style system, some minuor alterations may be needed for Debian/Ubuntu or Slackware or others.

share|improve this answer
    
sweet Link... Thanks –  Sparky Jan 12 '11 at 16:19
add comment
brctl addbr br0
ifconfig eth0 up
brctl addif br0 eth0
ifconfig eth1 up
brctl addif br0 eht1
ifconfig br0 <your.ip.address>

note that neither ethernet interface has an IP address; the single address is assigned to the bridge (br0).

share|improve this answer
add comment

I think this is what you are looking for. :D

Don't forget Promiscuous mode.

ifconfig eth0 promisc
ifconfig eth1 promisc
share|improve this answer
1  
i want to manually set this up. Can i define promiscous mode in the ifcfg-eth0 files or the ifcfg-bond file –  Sparky Jan 12 '11 at 15:49
    
Easy way would be rc.local. More correct way would be to write a bit of code for ifup-post, something like this: linux.derkeiler.com/Mailing-Lists/RedHat/2007-10/msg00178.html –  JakeRobinson Jan 12 '11 at 19:33
add comment

You could purchase a hub to replace the switch. It is cheap, the difficulty is merely to find one, now everyone prefers to use a switch. On the Internet you should be able to find one for a small cost.

The hub broadcasts all traffic to each port, by design.

In this case the current network topology would be enough (and set the Linux eth0 to promiscuous mode - otherwise the NIC will drop all packets that are not targeted to the Linux box. If you use wireshark to listen to the network, the soft can set the NIC in promiscuous mode automatically).

If you really want to use the "planned network", you can either

  • if you want the Linux to play an active network role, your best choice is to implement NAT-masquerading ; because I assume you don't have a class C network or, anyway, enough IPs to have the luxury of making your box a router. In this case, the WAN side should be your public (Internet) address, and the LAN side is a private network (like 10.1.1.1/24).
  • or, as suggested in a comment, make your box a bridge.

I would definitely go for the hub.

share|improve this answer
    
Oh yea didnt think of a hub. But my future plan will be to make my linux box plug and play for that i might as well go through the headache of this bridging malarchy. +1 for the HUB. i cant believe i forgot that. Ive been programming to long. Basic Network Leacture back in UNI 101. :D –  Sparky Jan 12 '11 at 15:57
    
You might be hard pressed to find a true dumb hub these days, as even the cheap and nasty devices you can get for less than a tenner are switches rather than hubs. –  David Spillett Jan 12 '11 at 16:15
    
Amazon has some seemingly amazon.com/Netgear-DS104-4-Port-Uplink-Button/dp/B00000J4LQ/… –  ring0 Jan 12 '11 at 16:25
    
You can also force a switch into hub mode on a temporary basis. But its a bit macguyver. –  Sirex Jan 12 '11 at 16:32
1  
@ring0: That doesn't look cheap though compared to a cheap switch, even a small Gbit one. And remember that if anything connects at 10Mbit it will be the other side of the switch to the 100Mbit devices. A 10/100 switching hub is essentially two hubs (1x 100Mbit, 1x 10Mbit) with a switch between so even in promiscuous mode you might not see all packets on one port. @Jake: yes, that can be a performance issue, which is why everyone uses switches where affordable (which is everywhere these days) unless they need hub-like behaviour. –  David Spillett Jan 13 '11 at 0:21
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.