Hi,

I have a question regarding setting up a linux box as a networking device. In a nutshell, I would like to configure a linux machine to function as a network tap.

My situation is, I have a linux machine and a windows machine, both with seperate IPs, on a switched network. I would like to configure the windows and linux machines such that whenver someone wants to access the windows machine, they would type in the IP of the windows box, but all traffic would go through the linux box first, before being forwarded. Conversely, whenever the windows machine makes an outgoing request/, the traffic would through the linux box first before being passed onto the network.

Is this possible? thnx.

Hi,

Take a look at these. They are straight forward:

http://www.debian-administration.org/articles/23

http://packages.debian.org/stable/net/ipmasq

http://www.e-infomax.com/ipmasq/howt...q-HOWTO-m.html

I personally use a Debian box with Shorewall, which is very easy to configure and modify, and two ethernet cards, each one with a different address.

http://www.shorewall.net/

Cheers,

thnx for the reply. But in all of the articles you posted, they talk about using the linux box as a NAT. What I want is for the windows box to still have a "public" ip, but have all the data go through the linux box prior to reaching the windows box.

The reason I am doing this is because I am setting up a honeypot of sorts, and the best infosec/IDS tools are linux based. Therefore, if I want to track/analyze hack attempts on my windows machine, the traffic must go through the linux box first.

BTW, check out www.ossim.net - Open Source Security Information Management...it's a collection of 10+ network tracking/IDS programs to help monitor your network.

thnx