Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We recently found a bug in a hardware vendor's ability to port aggregate to a monitoring port. They have given us an estimate og at least 6 months of development to get a fix. As this is an operational requirement for us, we need to figure out another way to get access to this packet data. Is there any way to mirror all traffic from a network interface in linux to another interface (both in and outbound)? Then we could attach the monitoring box to the second port and capture the data there.

share|improve this question
    
What about just using a tap? It's the least invasive operationally and it will pretty much always be useful. –  rnxrx May 30 '12 at 18:13
    
We would love to, however putting it into a production environment would require a lengthy QA period, and we don't really have time for it :( –  Matthew May 30 '12 at 18:58

1 Answer 1

up vote 2 down vote accepted

Two possible ideas:

  • Create a bridge between two interfaces and use brctl setageingtime 0 to ensure no addresses are learned and all packets not destined to the bridge host are forwarded across the interfaces.

  • Sourcefire's Daemonlogger can write all traffic on one interface to another interface.

share|improve this answer
    
daemonlogger looks like exactly what we need! I'll give it a shot, thank you! –  Matthew May 30 '12 at 18:59
    
Can you give a short explanation of what brctl setageingtime 0 does? –  exabrial Aug 27 at 18:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.