Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C.

To recreate some real world scenarios, I want to filter out all traffic which is a certain type (H.323 VoIP Signaling Packets) so that C sees a subset of the information that is flowing from A to B.

What would the easiest way to do this be? I assume I would need a computer with 2 NIC cards and some software to examine each packet and chuck out the H.323 VoIP packets?

share|improve this question
up vote 3 down vote accepted

You can do it with almost any hardware and software you want. You do need a PC with 2 NIC cards. Personally, I'd use Linux's software bridging and ebtables to enforce the filtering.

share|improve this answer

you could just use a capture filter in wireshark...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.