Setting up a linux switch

Question

I have a C++ Program to sniff each and every packet that crosses my linux box. However i need to now get my linux box to listen to every traffic in my network. I could buy a managed switch and set up port spanning, but i aint paying 200+ £'s for a switch and plus gives me a chance to learn.

My Network

                                            +---------Computer A
                                            |
Internet-----Router------Switch-------------+---------Linux Box
                                            |
                                            +---------Computer B

Proposed Network

                                            +---------Computer A
                                            |
Internet-----Router------Linux Box--------Switch
                    eth0^         ^eth1     |
                                            +---------Computer B

How would i setup this in linux. Do i just configure both the ethernet on different IP Address on the same network. Or am i completelly on the wrong track

My System

• Fedora 13.

Thanks

Answer 1

I'm assuming your current network is on a private subnet and that your router performs NAT for external communication (i.e. to the outside world all your machines look to have the same IP address). You have two options here:

1. set the machine up as a bridge
2. set the machine up as a NAT router

To set it up as a router:

• have eth0 setup as if it is a client to the current router
• have eth1 on a different subnet
• have the server configured to hand out addresses on this subnet to the other machines via DHCP
• add the approptiate iptables rules so the box performs NAT for outgoing connections from the eth1 side
• if you have any manual port forwarding setup on the router at the moment this will need to be set to point to the new box and the new box set to forward these connections further into the network

Exactly how you do some of the above perminantly (i.e. so it survives a reboot) depends on your Linux distribution and any other local network setup you need to respect. http://www.linuxjournal.com/article/8172 shows an example of a bridge setup using a RedHat/Fedora/CentOS style system, some minuor alterations may be needed for Debian/Ubuntu or Slackware or others.

Answer 2

brctl addbr br0
ifconfig eth0 up
brctl addif br0 eth0
ifconfig eth1 up
brctl addif br0 eht1
ifconfig br0 <your.ip.address>

note that neither ethernet interface has an IP address; the single address is assigned to the bridge (br0).

Answer 3

I think this is what you are looking for. :D

Don't forget Promiscuous mode.

ifconfig eth0 promisc
ifconfig eth1 promisc

Answer 4

You could purchase a hub to replace the switch. It is cheap, the difficulty is merely to find one, now everyone prefers to use a switch. On the Internet you should be able to find one for a small cost.

The hub broadcasts all traffic to each port, by design.

In this case the current network topology would be enough (and set the Linux eth0 to promiscuous mode - otherwise the NIC will drop all packets that are not targeted to the Linux box. If you use wireshark to listen to the network, the soft can set the NIC in promiscuous mode automatically).

If you really want to use the "planned network", you can either

• if you want the Linux to play an active network role, your best choice is to implement NAT-masquerading ; because I assume you don't have a class C network or, anyway, enough IPs to have the luxury of making your box a router. In this case, the WAN side should be your public (Internet) address, and the LAN side is a private network (like 10.1.1.1/24).
• or, as suggested in a comment, make your box a bridge.

I would definitely go for the hub.