cloning traffic with iptables

[mike.patterson at unb.ca (Mike Patterson)]

Robin Wood wrote on 1/6/09 4:23 AM:
> 2009/1/6 Don Berry <don_berry at comcast.net>:
> > Do it upstream on the network interfaces. Use the switch that the interface
> > is connected to and do port mirroring or cloning.
>
> I'm designing a device which can be dropped onto any point of a
> network to sniff traffic so need the device itself to do it.

Am I being simple, or is what you want just a bridge?  I did this with a
FreeBSD box, just bridged em0 to em1 and sniffed on the bridge device.
No reason you shouldn't be able to do something similar with iptables,
no?  (Of course, I hate iptables, which is why it was a BSD box and not
a Linux box, but I digress.)

Mike