# Mirroring traffic



## kiim11 (Aug 23, 2012)

Hi,
Can I mirror traffic from one interface to another using IPFW or PF?
Thanks, for help


----------



## SirDice (Aug 23, 2012)

What exactly do you mean with "mirror traffic"? Send the same packets to multiple machines? To what purpose?


----------



## kiim11 (Aug 23, 2012)

Yeah, send same packets duplicated(without any changes in original packets and without any changes in its routing/dropping etc) to another machine for analyze. I wanna organize something like cisco's 'monitor sessions'.


----------



## SirDice (Aug 23, 2012)

Ah, right. You can, for example, bridge(4) two network cards together, run tcpdump(1) and use it as a network tap between two hosts.

You can also configure your Cisco equipment with a SPAN port and just capture that traffic.


----------



## kiim11 (Aug 23, 2012)

Thanks a lot for reply,
I will try to do first. Unfortunately I haven't any cisco devices now and can't simply configure sessions and span, but I have gateway on FreeBSD.
Tried to do dup-to in pf.conf but didn't work properly (maybe I failed config).


----------

