Can I "tee" traffic on a TCP port?

bigearsbilly · 03-02-2012, 09:54 AM

OK I have a TCP service that gets called from outside.
It's in production 24x7.

I was wondering is there a way, without disturbing the status quo,
of splitting the traffic off to another port or server.
(I want to take a look at improving it)

Sort of like an aliased interface.
Like you can split stdout with tee for files?

MensaWater · 03-02-2012, 11:58 AM

tcpdump/wireshark doesn't do what you need to see the traffic?

bigearsbilly · 03-05-2012, 02:21 AM

I could probably just write a tcpdump filter.
Might as well learn it properly I guess.

I was just wondering if there was an easy way.

acid_kewpie · 03-05-2012, 03:16 AM

Not sure I can imagine an easier way... what would be a better scenario to you?

There IS a TEE output for iptables though, it does exist. But what are you going to do with it?

bigearsbilly · 03-05-2012, 03:24 AM

I have a data feed, a legacy system which receives data via xinetd.
It's legacy, live and very important.

I want to dissect and eventually control and replace it without stopping the flow
see what I mean?

I could call the provider get a backup feed blah blah but I hate paperwork.

zhjim · 03-05-2012, 03:25 AM

DEpending on your iptables version you can use the tee option.

http://dev.medozas.de/files/xtables/iptables.html

Search for "tee " to find the appropiate section.

acid_kewpie · 03-05-2012, 03:31 AM

Quote:

Originally Posted by bigearsbilly

I have a data feed, a legacy system which receives data via xinetd.
It's legacy, live and very important.

I want to dissect and eventually control and replace it without stopping the flow
see what I mean?

I could call the provider get a backup feed blah blah but I hate paperwork.

well teeing the traffic is only good for watching it, and possibly cutting connections etc. You can't make a difference service interact with it, as the other end is having a proper TCP conversation with a different bit of software. If you need to replace it, then you'd be looking at possibly putting in a temporary dnat or something, not to try to directly interfere with the traffic.