bstpierre's questions

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says:

The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression increments the filter offsets by 4.

When I do:

tcpdump -vv -i eth1 \( vlan 1000 \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)

I get captured packets.

But when I do:

tcpdump -vv -i eth1 \( vlan 1000 or vlan 501 \) and \( ip host 10.1.1.98 or ip host 10.1.1.99 \)

I don't get any packets -- I presume because of the "increment by 4" behavior described in the man page.

How can I capture traffic on more than one VLAN at a time?

I'm looking for a PCI NIC with two PHYs that is capable of bridging/switching in hardware but allows the host to monitor the traffic. Does such a thing exist?

This would be running on a linux host.

Edit: software bridging is not feasible for this application. I'm specifically looking for some model of card that will do hardware switching with monitor capability.

I have a php script that relies on the following rewrite rules:

RewriteEngine on
RewriteCond %{REQUEST_URI} !^/script.*$ [NC]
RewriteRule (.*)$ script.php/go [QSA,L]

So when someone visits http://example.com/foo, the script is called script.php/foo. This should be publicly visible.

When I visit http://example.com/script.php/adminstuff/ I'd like to use http basic authentication. (I know how to use this in the basic case.) How will this react with the rewrite rules above?

Thanks.