Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I am looking to make is a linux system that acts as a bridge. It simple forwards any data sent on one device over to the next device. It does not attempt to block incoming attacks or redirect any traffic. What it does to is perform an IDS role on the network. Any suspicious activity is logged and reported. Snort would be one such piece of software however I was wondering what other solutions and ideas the rest of the community has.

share|improve this question
up vote 1 down vote accepted

If all you want is to perform network monitoring, I would recommend some slight re-engineering. Putting a device inline, such as what you're suggesting, is really only useful when you want to be able to take action on the activity. Otherwise it only adds complexity to your network and adds an additional point of failure. You are better off monitoring the traffic passively using either mirrored ports or network taps.

The precise terminology for a mirrored port will be different depending on your vendor. For example, Cisco calls them Span Sessions, Juniper uses the term analyzer port, but in all cases what you do is have your network equipment (typically a switch or router) send a copy of some set of traffic to another port. The exact capabilities will depend on the hardware, but at minimum you should expect to be able to monitor all traffic going in or out of a specific port. Often you will want this to be the uplink, but will depend on exactly what you want to monitor and how your network is laid out. The biggest advantage to using a mirrored port is that it's cheap. This is a capability that already exists in pretty much all "enterprise" class hardware and simply requires that it be turned on. There can be a couple of disadvantages, however. Since this requires the network gear perform more stuff, it can impose additional load, so depending on how close to capacity you are it could be a problem. Most equipment also limits the number of things you can mirror as well. Most Cisco equipment is limited to two span sessions, and FYI installing an FSWM in a 6500 chassis consumes a span session. Having a limit of two is not normally a problem, but since it is a fairly low number it's definitely something to keep in mind.

Network taps get around the performance and scaling issues by being special purpose hardware devices that mirror the traffic. They work by sitting in-line and physically splitting the signals off. So while they are installed in-line, they are significantly more unlikely to suffer downtown than a computer. There do exist both copper and fibre versions, and they can be somewhat expensive (think $500-$1500USD expected). At the risk of shilling a specific vendor, NetOptics (a manufacturer of network taps) does have a reasonable write-up.

From this point using a system like Snort is relatively painless. No matter which method you go with, you'll likely have one or two cables that will be feeding you all the data you want. Then, you build your Snort box, put in an extra network card for monitoring, and plug in the cable from your monitoring port. Configure snort to listen on that interface and watch the false positives roll!

share|improve this answer
I understand what your saying, this is really just a personal project. My goal is to basically build a tap from scratch with nothing but old hardware and a Linux disc. My end result is a system that I can toss anywhere with a little config and get a general idea of the traffic entering/exiting the system along with any intrusions as well. – Blackninja543 Apr 11 '12 at 2:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.