Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a pretty specific requirement, detailed below. Here's what I'm not looking for help for, to keep things tidy and on topic:

  • How to configure a standard proxy
  • Any ESX setup required to facilitate traffic sniffing
  • How to sniff traffic
  • Any changes in design (my scope limits me)

I need to setup a test environment for a network-sniffing based HTTP app monitoring tool, and I need to troubleshoot a client issue but he only has a prod network, so making changes to the config on client's system "just to try" is costly.

The goal here is to create a similar system in my lab, and hit the client's webapp and redirect my traffic - using a proxy - into the lab environment. The reason I want to use a proxy is so that only this specific traffic is redirected for all to see, and not all my web traffic (like my visits to serverfault :P).

Everything will run inside an ESX 4.1 machine.

In there, there is a traffic collection vSwitch in promiscuous mode that is not on the local network for security reasons. The VM containing our listening agent is connected to this vSwitch.

On the same ESX host, I will setup a basic linux server and install a proxy (either apache + mod_proxy or squid, doesn't matter). I'm looking for ideas on how to deploy this for my needs so I can then figure out how to set it up accordingly.

Some ideas I've had were to setup two proxies, and have them talk to each other through this vSwitch in promiscuous mode, but it seems like a lot of work. Another idea is a dual-homed proxy, but I've never seen/done that before so I'm not sure how doable it is for what I'd like.

I am OK with setting up a second vSwitch in promiscuous mode to facilitate this if need be, but I cannot put the vSwitch on the lan (which is used so my browser would communicate with the proxy) in promiscuous mode.

share|improve this question
Why's the promisc mode vSwitch necessary? Couldn't you just capture traffic directly on the proxy system? –  Shane Madden Jun 20 '12 at 4:45
If all I was interested in was that - yes. Unfortunately, I'm doing this to send traffic to a sniffer that I work with here, and this is an attempt to enable a livedev environment for a client that's not willing to do so at his end, so I need to redirect my browser traffic to my company's sniffing solution using the proxy. --- that is, unless there's a way to feed traffic from the proxy directly into the listening port of this device? –  sandroid Jun 20 '12 at 12:26
Gotcha - so the HTTP proxy system cannot be connected only to the promisc mode vSwitch because that network's not accessible to the devices that need to connect to the proxy, correct? –  Shane Madden Jun 20 '12 at 16:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.