Wednesday, November 22, 2006

Any way to create a span/mirror port on WRT54G router

I want to duplicate all traffic coming in and out to one of 4 ports. After I spend 2 days online, I still can't figure out a WORKing solution.

First, the iptables is the most possible way to do this. 4Access mention there is a -tee switch on DD-WRT. So the following 2 lines can make this thing happen :
iptables -A PREROUTING -t mangle -s !192.168.0.0/24 -j ROUTE --gw --tee
iptables -A POSTROUTING -t mangle -s !192.168.0.0/24 -j ROUTE --gw --tee

Second, ettercap can perform ARP Spoofing , which may also achieve this goal.

My another thinking is use TCPDump on router and save the logs to share folder by Samba. Here has an article about how to use TCPDump.

Last but not least, try install Squid on a server to set up a proxy and doing log on this server may keep a histry for all HTTP accese. In router, force all HTTP request to this server by

To a different machine
iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 80 -j DNAT --to 10.0.3.1:8080

To the same machine
iptables -t nat -A PREROUTING -i $INTERFACE -p tcp --dport 80 -j REDIRECT --to-port 8080

No comments: