Mirroring traffic

[kiim11]

Hi,
Can I mirror traffic from one interface to another using IPFW or PF?
Thanks, for help

 

[SirDice]

What exactly do you mean with "mirror traffic"? Send the same packets to multiple machines? To what purpose?

 

[kiim11]

Yeah, send same packets duplicated(without any changes in original packets and without any changes in its routing/dropping etc) to another machine for analyze. I wanna organize something like cisco's 'monitor sessions'.

 

[SirDice]

Ah, right. You can, for example, bridge(4) two network cards together, run tcpdump(1) and use it as a network tap between two hosts.

You can also configure your Cisco equipment with a SPAN port and just capture that traffic.

 

[kiim11]

Thanks a lot for reply,
I will try to do first. Unfortunately I haven't any cisco devices now and can't simply configure sessions and span, but I have gateway on FreeBSD.
Tried to do dup-to in pf.conf but didn't work properly (maybe I failed config).