We recently found a bug in a hardware vendor's ability to port aggregate to a monitoring port. They have given us an estimate og at least 6 months of development to get a fix. As this is an operational requirement for us, we need to figure out another way to get access to this packet data. Is there any way to mirror all traffic from a network interface in linux to another interface (both in and outbound)? Then we could attach the monitoring box to the second port and capture the data there.

  • What about just using a tap? It's the least invasive operationally and it will pretty much always be useful. – rnxrx May 30 '12 at 18:13
  • We would love to, however putting it into a production environment would require a lengthy QA period, and we don't really have time for it :( – Matthew May 30 '12 at 18:58

Two possible ideas:

  • Create a bridge between two interfaces and use brctl setageingtime 0 to ensure no addresses are learned and all packets not destined to the bridge host are forwarded across the interfaces.

  • Sourcefire's Daemonlogger can write all traffic on one interface to another interface.

  • daemonlogger looks like exactly what we need! I'll give it a shot, thank you! – Matthew May 30 '12 at 18:59
  • Can you give a short explanation of what brctl setageingtime 0 does? – Jonathan S. Fisher Aug 27 '14 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.