0

Passive network taps seem to be pretty simple. What if I want an "active" network tap? Let's say I want to change some HTTP packets, for example add info etc. Another thing that would interest my project is that I would take a packet, inspect it and send it later or drop if suspect etc.

What about If i set my computer into a bridge mode and intercept traffic that way (I don't know if that is possible) instead of a passive tap.

Improve this question
6
  • 1
    An in-line device such as you describe would be a computer appliance similar to a firewall, proxy, etc. I wouldn't describe it as a tap. Assuming your computer is fast enough to process all the packets, you could intercept traffic.
    – Ron Trunk
    May 30, 2017 at 19:20
  • It sounds like you want a proxy, not a tap. A tap will not prevent the original packets from being delivered. You probably want to ask this question on Server Fault for a business network, or on Super User for a personal network. Much of what you ask about (protocols above OSI layer-4, host configuration, etc.) is off-topic here.
    – Ron Maupin ♦
    May 30, 2017 at 19:21
  • I think a proxy would not be suitable because that would involve changing network connect settings on user computers an that is always too much off a hassle. A tap (or bridge) does not require to change settings.
    – user1231247
    May 31, 2017 at 15:05
  • "A tap (or bridge) does not require to change settings. Right, but a tap or bridge will still let the original frames or packets through, only copying them for your use. A proxy actually takes the packets because the path is through the proxy.
    – Ron Maupin ♦
    Jun 1, 2017 at 12:59
  • Transparent proxy exist.
    – JFL
    Jun 1, 2017 at 13:17

3 Answers 3

Reset to default
3

It seems to me that you mis-understand the TAP concept. It only means that you duplicate a link. Then you are able for example :

  • to forward the first TAP output link to the destination (or next hop) and the second output TAP link to a monitoring device.
  • But you also can forward the first output TAP link to a firewall which will filter and/or modify the traffic and the second output TAP link can be forwarded to a monitoring (eg. netflow probe, ...). This is redundant if the firewall is already sending flow details to a monitoring system.

If by 'active TAP' you mean an active way to "trap"/capture traffic and forward it (or not) modified to the real destination, this can be achieved in several ways:

  • a box (eg. your computer, a firewall) is directly placed across the packet path (eg. at the network ingress)
  • the DNS (you spoke about HTTP) point to your box IP. Then your box will redirect the traffic towards the real server IP (eg. given the domain name)
  • you announce the end-server IP with BGP advertisements, so that ISPs/AS will forward you the traffic destinated to the end-server IP. You then redirect the traffic towards the server using tunneling methods (eg. GRE tunnels)
Improve this answer
2
  • I want to capture traffic/packets, analyze it and then pass it on the net unchanged or not. What I want to avoid is that users "downstream" don't have to change their network address settings.(change default gateway etc to redirect to a proxy). I am looking for a software + hardware (a PC) that sits between: router and pc:s on my LAN. Perhaps I should put a pc with pfsense to make it sort of inbetween router?
    – user1231247
    Jun 2, 2017 at 8:38
  • I have never used pfsense, but you can of course use any kind of firewall either hardware-based or software-based (pfsense, iptables and its configuration tools such as firehol or fwbuilder, ...). You can also use Intrusion Detection System such as Snort / Suricata (it seems that Snort is available through pfsense).
    – vera
    Jun 14, 2017 at 10:09
0

The easiest way to do this would be to use a linux machine with OpenVSwitch and iptables

OpenVSwitch give you a fine control over traffic forwarding and provide, among many other features:

  • NetFlow support so you can send this traffic to a NetFlow collector (that can run on the same machine or another one)
  • VLAN support
  • Port mirroring

and is particularly handy if you use virtual machines.

iptables allow you to modify, NAT or drop packets (or event frames) on the fly.

Many commercial solutions (including proxy as discussed in the question comments) are based on those software pieces.

As explained by @vera in her answer you need to configure your network so the traffic pass through your machine. This is very dependent on your network setup.

Improve this answer
0

Network tap is a passive splitting device placed between 2 network devices and provides a monitoring connection.

There is no active network taps, but to answer you needs you can use some other network devices.

For example you can use packet filtering to inspect, and make changes in HTTP packets.

I had a good experience with Ixia's PacketStack. With this device you can

  • Deduplicate

  • Insert a time-stamp into every packet to correlate events with other devices.

  • Trim packets, cut out the unnecessary information and reduce packet size to improve security and increase tool efficiency.

  • Hide or overwrite sensitive or personally identifiable information (PII) before providing the data to analysis tools.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.