Monitor Mode? HUB-Behaviour? Something like that...

5 posts / 0 new
Last post
Goddchen
Monitor Mode? HUB-Behaviour? Something like that...

Hi everyone :)

I need to attach a monitor device to my WGR614L. I'll run tcpdump there and need to monitor the traffic of another machine which is connected on one of the LAN ports.

Is there any way to achieve this?

Since it's a switch in the router and not a hub i won't receive any packets which are not addressed to my mac address.

Any ideas?

 

Goddchen

ciscostu
The iptables ROUTE target

The iptables ROUTE target (experimental) offers an option to clone traffic-

--tee             Route a copy of the packet, but continue traversing the rules with the original packet, undisturbed.

http://www.netfilter.org/projects/patch-o-matic/pom-external.html

Hope this helps,

Charlie

Goddchen
Hey, thx!

Hey, thx!
It's works perfectly :)
i did

iptables -A -t mangle -s -j ROUTE --gw --tee

great :)

Goddchen
btw: have a look here, i

btw: have a look here, i wrote a little blog post explaining my solution
http://blog.goddchen.de/2009/03/port-mirroring-span-port-monitor-port-wi...

Goddchen
Submitted the article, it's

Submitted the article, it's in moderation queue right now...