Not really a router job, usually the task of a switch....
but
Does anyone know if there is a way of hacking up MT to get it to do this ?
Dont want to do netflows or anything like that... just good ol' dumb layer 2 mirroring of ethernet port. Filtering would be a bonus.
Re: Port Mirroring ?
sorry, not an exact answer but maybe helpful:
Simple port-mirroring has some problems, especially with full-duplex traffic, for professional analysis, IDS, etc. therefore a TAP-device is needed, e.g.:
http://www.netoptics.com/products/produ ... =NetOptics
http://www.vssmonitoring.com/solutions/ ... tion01.asp
Simple port-mirroring has some problems, especially with full-duplex traffic, for professional analysis, IDS, etc. therefore a TAP-device is needed, e.g.:
http://www.netoptics.com/products/produ ... =NetOptics
http://www.vssmonitoring.com/solutions/ ... tion01.asp
1)take latest routerOS version
2) enable rstp-bridge package
3) create bridge interface
4) put all the ethernet ports in the bridge
5) disable connection tracking ( necessary only for mangle, firewall, nat)
6) disable network discovery
in the end you have managable switch
I use RB564 (9 ethernet ports) work like a charm - managable switch with total throughput above 200 Mbps
You can use PC and fill it up with something like RB44 (4 ethernets in 1 PCI) and you will get 6 PCI = 24 ethernet port managable switch with vlan traffic shapping, firewall filtering and so on!
2) enable rstp-bridge package
3) create bridge interface
4) put all the ethernet ports in the bridge
5) disable connection tracking ( necessary only for mangle, firewall, nat)
6) disable network discovery
in the end you have managable switch
I use RB564 (9 ethernet ports) work like a charm - managable switch with total throughput above 200 Mbps
You can use PC and fill it up with something like RB44 (4 ethernets in 1 PCI) and you will get 6 PCI = 24 ethernet port managable switch with vlan traffic shapping, firewall filtering and so on!
WoW! Wonderful idea! A very good maximaly managable "switch" that replaces x.000USD cisco/3com/etc equipment!You can use PC and fill it up with something like RB44 (4 ethernets in 1 PCI) and you will get 6 PCI = 24 ethernet port managable switch with vlan traffic shapping, firewall filtering and so on!
Macgaiver, you are genious!
-
-
andrewluck
Forum Veteran
- Posts: 700
- Joined:
- Location: Norfolk, UK
Xe, xe! Thx!WoW! Wonderful idea! A very good maximaly managable "switch" that replaces x.000USD cisco/3com/etc equipment!
Macgaiver, you are genious!
That total throughput - more than 200Mbps was only for RB500 (CPU 333MHz)
Yes. But look at the throughput, and compare that with an ASIC based switch. If you want switching then use a switch, especially at the network core. IMHO, routers are Edge devices.
I think if you take latest hardware (intel ethernet cards, P4 3000+ you will get plenty of traffic - the main thing tht I like in this configuration - you can protect one customer from another ( no more virus problems in whole "switch network") simple by using firewall filters.
Certainly a great concept I had never considered.
Am now using the latest packages and indeed, yes it works very well as a switch with a lot of features only ever found in high-end L2 switching devices. However I am still trying to work out a 'hack' for port mirroring and have had no luck as yet.
How can it physically Xmit data 'nowhere' just like port mirroring in a normal managed switch?
There's gotta be a way... bridge dst-nat maybe ?
In some ways I guess it is kinda like how a HUB works, but just want to replicate all data on one port and spit it out to another port with a 'sniffing' device attached to the end of it.
I realise the proper way to do this is with a real switch (go figure), however this patch-up is required asap until the gear in question arrives in another week or two....
Am now using the latest packages and indeed, yes it works very well as a switch with a lot of features only ever found in high-end L2 switching devices. However I am still trying to work out a 'hack' for port mirroring and have had no luck as yet.
How can it physically Xmit data 'nowhere' just like port mirroring in a normal managed switch?
There's gotta be a way... bridge dst-nat maybe ?
In some ways I guess it is kinda like how a HUB works, but just want to replicate all data on one port and spit it out to another port with a 'sniffing' device attached to the end of it.
I realise the proper way to do this is with a real switch (go figure), however this patch-up is required asap until the gear in question arrives in another week or two....
-
-
andrewluck
Forum Veteran
- Posts: 700
- Joined:
- Location: Norfolk, UK
This depends on how you define plenty.I think if you take latest hardware (intel ethernet cards, P4 3000+ you will get plenty of traffic
The other problem that requires consideration with a software based router/bridge is latency. A router has to read a complete packet before forwarding it. With large packets this represents a considerable (and variable) delay. Compare this to cut-through switching (switch decision after 6 bytes) or fragment-free (64 bytes) where you have a very low and predictable latency on each packet.
The number of switch ports that you require is also problematic. Four 4 port ethernet cards in a PC are going to overload the PCI bus completely, but you still have only 16 ports.
Not knocking the ideas here, just trying to introduce some of the other factors.
Regards
Andrew
Like I said earlier - setup packet sniffer to stream to another machine, then use trafr to receive it, and tcpreplay to rebroadcast on an interface. Not a very great hack but it works. Had to do this for a few months on a T1 interface since you can't mirror a T1 port on a switch.There's gotta be a way... bridge dst-nat maybe ?
Sam