building a (pass through?) sniffer
 

I was wondering what terms I should google to build the following:

I would like to build a linux box from an old computer that I would place between my cable modem and firewall (or between any computer on my network and the switch) It would have two NICs and all this box would do is record all the network traffic that goes over the wire.

I googled "sniffer" but since I'm using a switch I don’t see the traffic I'm interested in – which is why I'm thinking about building this box described above.

Any suggestions?

Thanks guys.

With 'ebtables' you can build yourself a 'brouter' (a Bridging router). This thing will accept packets at one end and spit them right out the other. Some people use this for an IP'less firewall (ie: remotely unhackable).

You could use such a bridge to sniff your traffic, record it, then pass it along as normal.

See:
http://www.linuxjournal.com/article/8172 (example for filtering traffic)
http://freshmeat.net/articles/view/1433/ (example with squid, but still valid)
http://ebtables.sourceforge.net/ (ebtables is like iptables, but at a lower level in the OSI model)

bulliver,

thanks for the info. it was exactly what I was looking for.

-Al