Hi all,

I was hoping someone might be able to point me in the right direction.

I would like to build a small pc which would have dual NICs and connect inbetween my router and main switch. I would like it to act as a kind of passthru device, accepting all packets from the router on one interface and forwarding them out of the other interface and vice versa.

My reason for doing this is that I would like to build a box that intercepts all traffic and performs advanced accounting techniques on the packets (mainly as a learning exercise), and forwards the packets on as if the box never existed. This will lead on to other related experiments I am interested in performing to learn more about IP packets.

Is it possible to do this by setting both NICs to promiscuous mode and enabling ip forwarding? Will i need iptables rules to perform this? I don't want to alter the packets in anyway, just send them straight to the other interface.

Many thanks for any help you can give me on the matter

Andy

It depends how transparent you want it. You could just have it act a router but the ttl will change giving away your presence and also if you have ICMP enabled then someone behind it can do a traceroute and get icmp unreachable. To prevent a basic traceroute you could just use ipforwarding, appropriate routing rules and disable ICMP.

However you will need to use ip tables mangling to fix the ttl issue.
There is a good tutorial on mangle rules at http://security.maruhn.com/iptables-...al/x10539.html

Then, yes, it is just a case of sniffing it as normal, however you only need to sniff one interface really, since any traffic going through it and not at it, will be getting processed on both interfaces.

Hi again,

I just wanted to clarify, although what i stated above sounds like I require a transparent bridge, I would (if possible) like the box to have no IP address at the present time (hence promiscuous). Also, when you bridge in linux, are you still able to interact with the layer 3? As I will need this for packet inspection.

Cheers,
Andy

Hi Jamesapnic,

Sorry, i didn't refresh before posting my 2nd thread so i didn't see your message.
Your reply was very useful, thanks very much for that!

Andy

Or just get a hub and connect your boxes to the hub. All traffic is right there for you to watch.

Yeah you could do that Make sure you use a read-only ethernet cable though, just to make sure. I think you might also need echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp for total transparency (or appropriate adapters). If you wanted to go with the box in the middle method.