Re: routing sniffed traffic

["Stephen J. Wilcox" <steve () telecomplete co uk>]

On Fri, 8 Oct 2004, Nils Ketelsen wrote:

> On Thu, Oct 07, 2004 at 09:43:47PM +0100, Stephen J. Wilcox wrote:
>
> [switching/routing traffic from a passive tap]
>
> > Hi Peter,
> >  if you are feeding this into a switch you should be able to switch it
> > just like the real traffic.. ie plug your fibers into gbics on
> > whatever switch you want to use, i dont see any special requirements for
> > this application
>
> I have no practical experience on that, I always used the monitor directly
> on the Tap, but I see a theoretical problem: Where does the switch switch
> it to? The Target MAC of the packet coming from the Tap will
> be still pointing to the device in the production network. 

statically configure your  mac to spoof that of the real interface.

> If you want to route it you will run into the same problem: The copied
> ethernet frame is not addresses to the router in the monitoring network,
> so it will not accept the Ethernet frame.

again just duplicate the ip address

> Maybe you could do something with faking the MAC on the router
> in the monitoring network to be the same as the MACaddress of the target
> in the production network, but it feels like a dirty hack. 
>
> Or am I missnig something obvious here?

ok so you have the same thoughts.. the key point is the original question 
suggested this 'copycat' network is not connected to the real net, and so long 
as you dont allow the packets to be routed back into the real net (and hence 
create dups) you should be fine.

Steve

> Nils