Possible to port mirror or duplicate packets?



  • I have a strange question…

    Is it possible to "port mirror" or duplicate packets using pfSense?

    For example, whenever packets match a certain filter (i.e. TCP ADDR 192.168.0.25, port 80), duplicate that packet to another IP address, etc.

    Does that make sense?  It's sorta like a poor-man's port filtering.



  • What are you trying to do with the duplicated packet?

    I do this at the switch level - Cisco calls it "port monitoring".  I had ntop installed on pfsense and connected to the mirrored port on the switch.

    -Lou



  • Yeah, I'm having a problem with my switch.  It's a Dell PowerConnect 2824 managed switch, and it supports port mirroring, but on my "low end" model it doesn't allow mirroring if VLANs are enabled which I use.

    What I'm trying to do is send any SIP INVITE packets to a sniffer application to read the caller id and broadcast it on my network (for call notifications, etc).

    I'd rather not setup a full SIP proxy or anything… The SIP sniffer I have already reads caller id so I just need to get those packets to my sniffer and my VOIP adapter (of course).


  • Rebel Alliance Developer Netgate

    Not sure if you can do it with just one port, but if you bridge two ports together you can add a third port as a "span" port and it receives copies of every frame transmitted across the bridge.



  • I'm still somewhat of a pfsense newbie, but since there is no obvious "rule" (would be nice if there was PASS, BLOCK, REJECT, MIRROR :) ), not sure if can do this.  You could "rig" it up in a pinch using a hub…... I know, far less than ideal but if it limps you along in the meantime while you figure something else out, it's worth contemplating at the least.


Locked