Set up a monitor/copy port for sniffer?

[shavano]

Is it possible to use a third interface to monitor traffic with Ethereal?

I'd like to be able to use rules to copy interesting traffic out another interface for analysis on an external system.  Ideally, that would include the original layer-2 info.

The book, Absolute OpenBSD, has several chapters on pf and it describes attaching Ethereal to pflog, but that requires running Ethereal on the firewall.  I'm not sure my Mini-ITX with a Via Eden 533 has the power for all that, though the bigger challenge for me would be figuring out how to add X and Ethereal.

[sullrich]

Not in 1.0.  1.1 (HEAD) has pf tee support.

[shavano]

So, pf is getting a feature similar to what is currently in ipfw?

Are you expecting to add some GUI capability for configuring and making use of it?

I tried to use it in ipfw a couple months ago but gave up after a couple weeks of on and off effort at making it do anything useful.  My ignorance exceeded my patience.

[hoba]

Expect this feature to be added in the pfSense way: nice gui, easy to setup, more time for the fun part of life  ;D

[shavano]

That sounds exciting, especially if you're thinking along the same lines as paragraph 2 in my original question, like the capability you get on some of the Cisco enterprise-class switches.  It'll save me having to drag out and connect in a hub every time I want to monitor something.

I'm glad I moved over to pfSense.  You guys are doing great work!