I have a bridge/switch set up an a machine that has multiple ports. Occasionally, I have a vm running through virtualbox, and I'll have it use a virtual adapter and then I add the adapter to the bridge. I have heard that some switches can copy all the traffic they see to a specific port on the bridge, usually for network monitoring. I would like to be able to run some windows based network tools. I do not want to run Windows on the actual hardware, because it would be lots of work to duplicate my setup in windows, so I was thinking if I can copy all traffic to a port, I can send it to a VM with windows. How can I set this up? I think this might be ebtables area, but I don't know ebtables well enough to know for sure, and it always seems like (from my understanding of ebtables) ebtables does something with the traffic (drop, accept, etc), but never copies it.
I think that daemonlogger will do want you want.
It is is the repository, so
Syntax would be similar to
where the arguments are explained as
The biggest caveat is that you need to make sure that the destination port is capable of receiving the retransmitted traffic.
If you need more specific configuration guidance, you'd need to give more details on your bridge and interface setup.
I do not believe this is possible with a Linux-based software bridge (at least, not in its current version). If it were, it should be an option in the brctl utility.
Yes, many physical Ethernet switches have some kind of a mirroring/monitoring capability, which would allow you to designate an interface within the bridge to send all traffic to. It sounds like this would be a good enhancement for situations like yours.
Edit: you may be able to use a traffic control rule to accomplish this.