Using a multihomed PC to sniff traffic inline

By Thatguy031415
Sep 26, 2014
Post New Reply
  1. I'm a security analyst, not a network engineer. As such, all my understanding of how networks are set up is basically conceptual. That said, I have a few extra computers laying around, and decided to run a NIDS on my home network. The machine I plan to use as a sensor has two ethernet NICs and a wifi card. Basically, I want to plug the modem into one ethernet port, and the router into the other, and have the machine inspect the packets as they pass through...this should give me visibility on every packet that enters or leaves my network. Problem is, I have no idea how to configure this. I wish it was as easy as 'plug and play,' but clearly that isn't going to work. How do I set up the machine to take traffic coming from the modem on one ethernet card, and pass it along to the router on the other?

    Let's router, unfortunately, is not configurable for SPAN, so that won't work. I have a DIR-868L Wireless AC router, and the machine I want to use as a sensor is running Windows 8.1

    What other information might anyone need in order to help me out with this?
  2. jobeard

    jobeard TS Ambassador Posts: 9,318   +618

    Let's sync up on the concept, you want

    ISP=>modem<--->MonitoringPC<-->siteRouter <- - -> all lan attached users.

    You realize that the MonitoringPC will need to disable its firewall and thus be exposed to all sorts of exposures.

    You have at least two instrumentation points (a) the modem-side port vs (b) the router side port AND
    you need the routing table tweaked.

    If you place software between (a) & (b) ports, then there's a proxy to be configured.
  3. jobeard

    jobeard TS Ambassador Posts: 9,318   +618

    Btw: multihome is a tad different than the original layout in (1)
    1. ISP=>modem<--->MonitoringPC<-->siteRouter <- - -> all lan attached users.
    2. ISP1=>modem/router[1]<--->PC<-->[2]router/modem<-->ISP2
    In (2) there are two ways to access the Internet, specifically using two ISP connections
    (best if they are unique, but that's not required). A multihomed system has two or more default routes.

    in (1) the PC just has two NIC adapters and there will be only one default route in the routing table.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...