Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine (I don't care whether to run Windows or Linux on it), which has many (eight) NIC in it. I want to relay communications coming in from NIC, to go out thru two other NICs. Specifically, I'm interested in HTTP traffic, but I'd rather be general to all IP traffic.

The result should look like a port-mirror done in software.

Is this possible? If so, how?

share|improve this question
up vote 1 down vote accepted

There's no built-in functionality in either Windows or contemporary Linux kernels to do what you're looking for. You could do it in user-land in either OS, but it's going to be latent.

If you really want to do it, you might look at some open source IDS / IPS packages as a starting point. A package that does layer 7 inspection could probably be shimmed to do what you're looking for with HTTP traffic.

You're better off just using a switch to do what you want. It'll be very close to wire-speed and won't be a dodgy hack. Once you factor your time in, too, it's probably going to be cheaper.

share|improve this answer

netcat (nc / nc.exe) can do that, I think.

Though honestly the typical answer to this is with a software firewall, IPtables/ipchains can do that easily, or with an HTTP proxy like squid.

See some of the other answers:

share|improve this answer

I think iptables with the MIRROR and probably FORWARD options on a linux system should do work.

share|improve this answer
The box is going to have to actively be involved in the delivery of those packets to do that (and you're probably going to have to use ebtables instead of iptables). It's going to be rather latent, too, as compared to just using a switch. – Evan Anderson Jun 15 '09 at 14:32

What about bridging? If I'm not misunderstanding the question (which I could be), bridging the required connections should be exactly what you're looking for.

share|improve this answer
No-- it won't. A bridge only forwards unicast frames from a source interface to a single destination interface. He wants to forward unicast frames to multiple destinations. – Evan Anderson Jun 16 '09 at 2:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.