Linux, "port mirror" between two boxes...

kristiandg

New Member
Joined
May 4, 2022
Messages
2
Reaction score
1
Credits
29
Good morning, all.

With the push to migrate things to the cloud, there's obviously still a few things you can't pull off like you can on good ol' on-prem hardware, leaving a deficiency for something I need that I'm hoping can be filled with software.


I have a Linux (Ubuntu) box that needs a second Linux box to "port-mirror" it's traffic. I've found several things on the internet suggesting this can be done, but no definitive guide to do so. Both machines will have their primary ETH0 interface to the outside world, then will both have an ETH1, which I hope to use as some sort of bridge between them. Basically, a virtual "crossover cable" between them (over IP, but without modifying the data collected).

Since Wireshark/PCAP allows remote capture over SSH, I had hoped someone would have written a virtual ethernet "driver" that I could load on Server 2 that basically establishes that remote pcap link to Server 1 in order to stream the traffic to the second box, but haven't been able to find anything.

Does anyone have any thoughts on how this might be able to be achieved? Server 1 would handle all the traffic for the application, and Server 2 merely exists to monitor all the traffic going in/out of that Server 1's ETH0 interface.

Thanks.
 


Hello kristian,

Have you looked at this:


While it's not a "driver", the port mirror setup described could be adapted to your needs.

You would mirror `Box1_eth0` to `Box1_eth1`, each on a different network, of course, on the same machine. `Box1_eth1` treats `Box2_eth1` as its gateway, sharing the same network.

I have not tried this yet, but I have a similar requirement and shall soon test.

Best of luck!
 
I discovered (quite by accident) that the application doing the mirroring, specifically has an agent that can run on the primary server, to do this very thing, so at this time, I won't need this functionality. However, I can think of 100 possible needs for such a thing, so please update this thread with your results, as I'm sure others will have such a need as well and now will have a decent place to reference to pull it off.

Thanks.
 

Staff online

Members online


Latest posts

Top