0

I have a machine (I don't care whether to run Windows or Linux on it), which has many (eight) NIC in it. I want to relay communications coming in from NIC, to go out thru two other NICs. Specifically, I'm interested in HTTP traffic, but I'd rather be general to all IP traffic.

The result should look like a port-mirror done in software.

Is this possible? If so, how?

4 Answers 4

1

There's no built-in functionality in either Windows or contemporary Linux kernels to do what you're looking for. You could do it in user-land in either OS, but it's going to be latent.

If you really want to do it, you might look at some open source IDS / IPS packages as a starting point. A package that does layer 7 inspection could probably be shimmed to do what you're looking for with HTTP traffic.

You're better off just using a switch to do what you want. It'll be very close to wire-speed and won't be a dodgy hack. Once you factor your time in, too, it's probably going to be cheaper.

0

netcat (nc / nc.exe) can do that, I think.

Though honestly the typical answer to this is with a software firewall, IPtables/ipchains can do that easily, or with an HTTP proxy like squid.

See some of the other answers: Forward port to another Ip/port Port mirroring as a Windows service

0

I think iptables with the MIRROR and probably FORWARD options on a linux system should do work.

1
  • The box is going to have to actively be involved in the delivery of those packets to do that (and you're probably going to have to use ebtables instead of iptables). It's going to be rather latent, too, as compared to just using a switch. Jun 15, 2009 at 14:32
0

What about bridging? If I'm not misunderstanding the question (which I could be), bridging the required connections should be exactly what you're looking for.

1
  • No-- it won't. A bridge only forwards unicast frames from a source interface to a single destination interface. He wants to forward unicast frames to multiple destinations. Jun 16, 2009 at 2:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .