Home / server / Questions / 25865
Accepted
Moshe
Asked: 2009-06-16 05:57:19 +0800 CST

Software port mirror

  • 772

I have a machine (I don't care whether to run Windows or Linux on it), which has many (eight) NIC in it. I want to relay communications coming in from NIC, to go out thru two other NICs. Specifically, I'm interested in HTTP traffic, but I'd rather be general to all IP traffic.

The result should look like a port-mirror done in software.

Is this possible? If so, how?

networking

4 Answers

  1. Best Answer

    There's no built-in functionality in either Windows or contemporary Linux kernels to do what you're looking for. You could do it in user-land in either OS, but it's going to be latent.

    If you really want to do it, you might look at some open source IDS / IPS packages as a starting point. A package that does layer 7 inspection could probably be shimmed to do what you're looking for with HTTP traffic.

    You're better off just using a switch to do what you want. It'll be very close to wire-speed and won't be a dodgy hack. Once you factor your time in, too, it's probably going to be cheaper.

    • 1

  2. netcat (nc / nc.exe) can do that, I think.

    Though honestly the typical answer to this is with a software firewall, IPtables/ipchains can do that easily, or with an HTTP proxy like squid.

    See some of the other answers: Forward port to another Ip/port Port mirroring as a Windows service

    • 0

  3. I think iptables with the MIRROR and probably FORWARD options on a linux system should do work.

    • 0

  4. What about bridging? If I'm not misunderstanding the question (which I could be), bridging the required connections should be exactly what you're looking for.

    • 0