We recently found a bug in a hardware vendor's ability to port aggregate to a monitoring port. They have given us an estimate og at least 6 months of development to get a fix. As this is an operational requirement for us, we need to figure out another way to get access to this packet data. Is there any way to mirror all traffic from a network interface in linux to another interface (both in and outbound)? Then we could attach the monitoring box to the second port and capture the data there.
Two possible ideas:
Create a bridge between two interfaces and use
brctl setageingtime 0to ensure no addresses are learned and all packets not destined to the bridge host are forwarded across the interfaces.
Sourcefire's Daemonlogger can write all traffic on one interface to another interface.