My goal was to add a box between two routers I have so that I can monitor and analyze network traffic, use it as a syslog server for both routers, and mail alerts when appropriate. Although using an old repeater hub would most likely accomplish what I want easier, I've not been able to find one for purchase.
Based on tips from the Wireshark wiki, I set up a Linux box as a bridge by adding the br interface, setting eth0/1 to 0.0.0.0 ip addresses, and bringing up the interfaces anew. But I quickly realized in the process that the configuration does not give me any network interfaces I can use for the logging service, and I am not sure I can run snort or other monitoring tools against a br0 interface. I can test the latter, but before I spend time doing that:
- Am I missing something in my networking understanding about setting up a bridge that would in fact allow me to also assign addresses to the eth0/1 interfaces? (If I'm interpreting this stack exchange post correctly, I believe the answer is no.)
- If in fact I cannot configure this box to accomplish my goal while configured as a bridge, are there ways to accomplish this other than setting the box as a router?
- Or, is setting it up as a router overall the best approach if I cannot find a repeater hub (and I don't have a switch capable of port mirroring)?