I want to use the the new NetBSD's NPF firewall on a gateway that also has the legal obligation to log the traffic for 1 year. To offload the gateway, I though to put the logging stuff (and IDS, quota management, ..) on another machine (probably on Debian).
I though of 2 solutions to do so :
- recopying the traffic to the other machine
Unlike FreeBSD and OpenBSD, I'm not sure if NetBSD is able to setup this king of port, and if it is, I don't know how. http://man.netbsd.org/bridge.4 indicates
The bridge driver currently does not support snooping via bpf(4).
but in an older version it was
The bridge driver currently does not support snooping via bpf(4) or transparent filtering.
So maybe there's a way, but I don't know where to start, any help ?
- run tcpdump on the NetBSD machine and continuously sync the log file with the analyse machine
But how ? It has to be reliable and adapted to network log file (ie continuously written).