Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For debugging reasons i need to see what network traffic especially TCP is transmitted or not.

I thought about using an Endian firewall for this, but it doesn't support 2 network interfaces with the same IP range.

I am looking for a Linux solution which I can plug between the two switches in order to monitor all traffic passing by.

What I found out so far is that I am probably searching for a "transparent firewall" solution.

share|improve this question
Do your switches support port mirroring? – EEAA Apr 22 '13 at 12:28
The "big" Cisco probably but the on desk I have not – Dukeatcoding Apr 22 '13 at 12:34
up vote 2 down vote accepted

The best option for me would be to put a network tap between the switches. You can however put a Linux box with 2 interfaces and set it up as a bridge.

# brctl addbr br0
# brctl addif br0 eth0
# brctl addif br0 eth1
# brctl setageing br0 0
# ip link set dev br0 up promisc on

Then you can look at the traffic traversing the bridge using tcpdump as usual.

# tcpdump -i br0
share|improve this answer
that sounds intersting can i use tcpdump after that to see the traffic going through ? – Dukeatcoding Apr 22 '13 at 12:48
Yes you can, tcpdump -i br0. – Spack Apr 22 '13 at 12:51
i am reading to brctl man right now looks intersting, if i read your code i get: 1. Setup broadcast 2. add eth0 3. add eth1 , what to the last 2 lines do ? – Dukeatcoding Apr 22 '13 at 12:52
Ageing is the bridge ability to remember of which port as been seen a MAC address. The command prevents deletion and have faster forwarding. It is not mandatory however. The last command is just to bring the bridge up, promisc on asks to the kernel to look at every frame even if it is not for the bridge (MAC address) so you can monitor all the traffic. – Spack Apr 22 '13 at 13:00
ok nice, i am preparing an ubuntu system atm and try it – Dukeatcoding Apr 22 '13 at 13:01

From your post I understand that:

  • One of the two switch is a Cisco switch.
  • You only want to monitor traffic between the two switches. Not including traffic from the non-Cisco switch to other destinations.

In this case, connect a machine, linux or otherwise, to your Cisco switch. On the Cisco switch configure port-mirror to copy all packets to the port where your machine is.

On your machine, use tcpdump, wireshark or anything like that.

It does not require a Cisco switch to do that, but any managed switch which has the port monitoring feature.

share|improve this answer

If its only about monitoring and not filtering a passive network tap device would work.

share|improve this answer
i only want to see if traffic is floating or not – Dukeatcoding Apr 22 '13 at 12:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.