2

We recently found a bug in a hardware vendor's ability to port aggregate to a monitoring port. They have given us an estimate og at least 6 months of development to get a fix. As this is an operational requirement for us, we need to figure out another way to get access to this packet data. Is there any way to mirror all traffic from a network interface in linux to another interface (both in and outbound)? Then we could attach the monitoring box to the second port and capture the data there.

Improve this question
2
  • What about just using a tap? It's the least invasive operationally and it will pretty much always be useful.
    – rnxrx
    May 30, 2012 at 18:13
  • We would love to, however putting it into a production environment would require a lengthy QA period, and we don't really have time for it :(
    – Matthew
    May 30, 2012 at 18:58

1 Answer 1

Reset to default
3

Two possible ideas:

  • Create a bridge between two interfaces and use brctl setageingtime 0 to ensure no addresses are learned and all packets not destined to the bridge host are forwarded across the interfaces.

  • Sourcefire's Daemonlogger can write all traffic on one interface to another interface.

Improve this answer
2
  • daemonlogger looks like exactly what we need! I'll give it a shot, thank you!
    – Matthew
    May 30, 2012 at 18:59
  • Can you give a short explanation of what brctl setageingtime 0 does?
    – Jonathan S. Fisher
    Aug 27, 2014 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .