Sorry if this has been asked before, but I am not even sure what to google for an answer so I thought I'd ask all of you.
The company I work for has been having some slow Internet issues, after much investigation ATT our T1 provider told us our line was saturated with traffic. so we started analyzing our internal traffic and according to Wireshark over an hour period we averaged only .391 MBits/s for traffic, but our Internet connection was still very slow during that time frame.
So let me give you an idea of our network
I modified this to get my wireshark info and it looks like this
|-->Linux Server running Wireshark
What I would like to do is place the Linux server at this point between the firewall and switched network so it looks like this
This way I could run a realtime bandwidth monitor on Network traffic inbound and outbound from our internet connection.
My issue is that I am unsure how to configure it to bridge this way. I know I could use IP tables to NAT, but I want everything on the same subnet. and only want to put the server in-line. Currently eth0 is configured as 192.168.100.11 and eth1 is 192.168.100.6 the DHCP server tells everything the gateway is 192.168.100.1 I would like to not change that either.
Is there any way to bridge this? Would I set up a bridge interface br0 and add eth1 and eth2 to it and would that allow all traffic to pass through it looking for the gateway, do I need to use IPtables to route traffic from eth1-->eth0 and back?
I appreciate all your help thanks.