Not really a router job, usually the task of a switch…
but
Does anyone know if there is a way of hacking up MT to get it to do this ?
Dont want to do netflows or anything like that… just good ol’ dumb layer 2 mirroring of ethernet port. Filtering would be a bonus.
sorry, not an exact answer but maybe helpful:
Simple port-mirroring has some problems, especially with full-duplex traffic, for professional analysis, IDS, etc. therefore a TAP-device is needed, e.g.:
1)take latest routerOS version
enable rstp-bridge package
create bridge interface
put all the ethernet ports in the bridge
disable connection tracking ( necessary only for mangle, firewall, nat)
disable network discovery
in the end you have managable switch
I use RB564 (9 ethernet ports) work like a charm - managable switch with total throughput above 200 Mbps
You can use PC and fill it up with something like RB44 (4 ethernets in 1 PCI) and you will get 6 PCI = 24 ethernet port managable switch with vlan traffic shapping, firewall filtering and so on!
You mean acting like a HUB and send the same data to two (or more ports)?
NO it is switch! data will be transmited only to specific host!
WoW! Wonderful idea! A very good maximaly managable “switch” that replaces x.000USD cisco/3com/etc equipment!
Macgaiver, you are genious! 
Yes. But look at the throughput, and compare that with an ASIC based switch. If you want switching then use a switch, especially at the network core. IMHO, routers are Edge devices.
Regards
Andrew
OK, I agree. But, idea for another Mikrotik implementation: as switch, was not even close to my mind
Xe, xe! Thx!
That total throughput - more than 200Mbps was only for RB500 (CPU 333MHz)
I think if you take latest hardware (intel ethernet cards, P4 3000+ you will get plenty of traffic - the main thing tht I like in this configuration - you can protect one customer from another ( no more virus problems in whole “switch network”) simple by using firewall filters.
Well, it`s worth trying with P4 3GHz and test what throughput will come out
Certainly a great concept I had never considered.
Am now using the latest packages and indeed, yes it works very well as a switch with a lot of features only ever found in high-end L2 switching devices. However I am still trying to work out a ‘hack’ for port mirroring and have had no luck as yet.
How can it physically Xmit data ‘nowhere’ just like port mirroring in a normal managed switch?
There’s gotta be a way… bridge dst-nat maybe ?
In some ways I guess it is kinda like how a HUB works, but just want to replicate all data on one port and spit it out to another port with a ‘sniffing’ device attached to the end of it.
I realise the proper way to do this is with a real switch (go figure), however this patch-up is required asap until the gear in question arrives in another week or two…
I think if you take latest hardware (intel ethernet cards, P4 3000+ you will get plenty of traffic
This depends on how you define plenty.
The other problem that requires consideration with a software based router/bridge is latency. A router has to read a complete packet before forwarding it. With large packets this represents a considerable (and variable) delay. Compare this to cut-through switching (switch decision after 6 bytes) or fragment-free (64 bytes) where you have a very low and predictable latency on each packet.
The number of switch ports that you require is also problematic. Four 4 port ethernet cards in a PC are going to overload the PCI bus completely, but you still have only 16 ports.
Not knocking the ideas here, just trying to introduce some of the other factors.
Regards
Andrew
Like I said earlier - setup packet sniffer to stream to another machine, then use trafr to receive it, and tcpreplay to rebroadcast on an interface. Not a very great hack but it works. Had to do this for a few months on a T1 interface since you can’t mirror a T1 port on a switch.
Sam