jeniffer <zenith.of.perfection@gmail.com> wrote: > I have to implement port mirroring feature in linux.ie All inbound- > outbound packets of a particular interface are mirrored to another > interface. I need to implement it in both the bridging and routing > paths.Is there any utility in linux which helps to do this? A bit of coding around libpcap to sniff traffic on one or more interfaces and then just dump them out the desired interface sounds like it would do the trick. If the mirror interface is also being sniffed it might require a bit more logic to avoid loops. rick jones -- web2.0 n, the dot.com reunion tour... these opinions are mine, all mine; HP might not want them anyway... :) feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

Markus Rehbach <Markus.Rehbach@gmx.de> wrote: > Rick Jones wrote: > > A bit of coding around libpcap to sniff traffic on one or more > > interfaces and then just dump them out the desired interface sounds > > like it would do the trick. If the mirror interface is also being > > sniffed it might require a bit more logic to avoid loops. > Something like tcpbridge? Perhaps, I've never seen tcpbridge. Actually, I'm surprised that the Linux bridging code doesn't have support for designating a mirror interface. I'd have thought it was there already. Although I suspect the argument might be that if you want to see traffic just sniff the interfaces making-up the bridge. rick jones -- a wide gulf separates "what if" from "if only" these opinions are mine, all mine; HP might not want them anyway... :) feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...