Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We recently found a bug in a hardware vendor's ability to port aggregate to a monitoring port. They have given us an estimate og at least 6 months of development to get a fix. As this is an operational requirement for us, we need to figure out another way to get access to this packet data. Is there any way to mirror all traffic from a network interface in linux to another interface (both in and outbound)? Then we could attach the monitoring box to the second port and capture the data there.

share|improve this question
What about just using a tap? It's the least invasive operationally and it will pretty much always be useful. – rnxrx May 30 '12 at 18:13
We would love to, however putting it into a production environment would require a lengthy QA period, and we don't really have time for it :( – Matthew May 30 '12 at 18:58
up vote 2 down vote accepted

Two possible ideas:

  • Create a bridge between two interfaces and use brctl setageingtime 0 to ensure no addresses are learned and all packets not destined to the bridge host are forwarded across the interfaces.

  • Sourcefire's Daemonlogger can write all traffic on one interface to another interface.

share|improve this answer
daemonlogger looks like exactly what we need! I'll give it a shot, thank you! – Matthew May 30 '12 at 18:59
Can you give a short explanation of what brctl setageingtime 0 does? – Jonathan S. Fisher Aug 27 '14 at 18:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.