For debugging reasons i need to see what network traffic especially TCP is transmitted or not.

I thought about using an Endian firewall for this, but it doesn't support 2 network interfaces with the same IP range.

I am looking for a Linux solution which I can plug between the two switches in order to monitor all traffic passing by.

What I found out so far is that I am probably searching for a "transparent firewall" solution.

  • 1
    Do your switches support port mirroring? – EEAA Apr 22 '13 at 12:28
  • The "big" Cisco probably but the on desk I have not – Dukeatcoding Apr 22 '13 at 12:34

The best option for me would be to put a network tap between the switches. You can however put a Linux box with 2 interfaces and set it up as a bridge.

# brctl addbr br0
# brctl addif br0 eth0
# brctl addif br0 eth1
# brctl setageing br0 0
# ip link set dev br0 up promisc on

Then you can look at the traffic traversing the bridge using tcpdump as usual.

# tcpdump -i br0
  • that sounds intersting can i use tcpdump after that to see the traffic going through ? – Dukeatcoding Apr 22 '13 at 12:48
  • Yes you can, tcpdump -i br0. – Spack Apr 22 '13 at 12:51
  • i am reading to brctl man right now looks intersting, if i read your code i get: 1. Setup broadcast 2. add eth0 3. add eth1 , what to the last 2 lines do ? – Dukeatcoding Apr 22 '13 at 12:52
  • Ageing is the bridge ability to remember of which port as been seen a MAC address. The command prevents deletion and have faster forwarding. It is not mandatory however. The last command is just to bring the bridge up, promisc on asks to the kernel to look at every frame even if it is not for the bridge (MAC address) so you can monitor all the traffic. – Spack Apr 22 '13 at 13:00
  • ok nice, i am preparing an ubuntu system atm and try it – Dukeatcoding Apr 22 '13 at 13:01

From your post I understand that:

  • One of the two switch is a Cisco switch.
  • You only want to monitor traffic between the two switches. Not including traffic from the non-Cisco switch to other destinations.

In this case, connect a machine, linux or otherwise, to your Cisco switch. On the Cisco switch configure port-mirror to copy all packets to the port where your machine is.

On your machine, use tcpdump, wireshark or anything like that.

It does not require a Cisco switch to do that, but any managed switch which has the port monitoring feature.


If its only about monitoring and not filtering a passive network tap device would work.



  • i only want to see if traffic is floating or not – Dukeatcoding Apr 22 '13 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.