I'd like to build a network tap device, to intercept traffic between my PC and router. Imagine the raspberry pi or similar device, running linux, having two ethernet ports. I plug it in between my router and computer, acting as a simple "switch", relaying traffic between router and PC. I'd like to intercept that traffic, i.e. monitor it and log some data when patterns are matched.

Preferably, it would be great if I could also modify packets. Also preferably, it would be great if my device could be "invisible" in the network, i.e. not detected as a network device standing between router and PC. But if that's not possible, it's ok if it'll be identified as network switch.

I understand this would probably be a non-trivial project, so I'm not expecting full recipes here. I'm looking for some guidance about where to start, what possibilities exist, etc.

Last time I checked Windows was so restrictive in terms of networking that this would probably be impossible to build with Windows device (no matter how many Ethernet ports it would have). Linux, on the other hand, is more capable, but still some folks I asked said that it might not be possible without very serious system programming (messing with kernel, etc.). My coding skills with Linux are limited with Python general-purpose (i.e. not system-level) programming.

So... how (if at all) could this be accomplished? What architecture can you propose for such a device? What do I have to learn in terms of Linux network programming, to build such a project? In short... what do I start with?

About me: I'm senior software engineer (.Net / Web Dev), with "developer-level" (i.e. intermediate) understanding of networking, some experience with Wireshark and similar tools, and very limited experience with Linux.

closed as too broad by user34720, countermode, Toby Speight, GAD3R, Kusalananda Feb 24 '17 at 19:43

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What type of modifying packets are you talking about? Something as simple as "tapping" the network in some situations could be as trivial as turning on port mirroring on a little switch. On the other hand, distros like pfsense can probably modify traffic based on some characteristics – cutrightjm Feb 15 '17 at 10:23
  • Yes, a RaspPi with two ethernet ports will work fine between any two machines. If you are running Linux on your PC, you can also use netfilter/iptables for a purely software based solution, including filtering and modifying packets (no extra RaspPi necessary, no kernel programming necessary). You'll need to a do a lot of reading first, however. :-) – dirkt Feb 15 '17 at 12:11
  • This could prove easier/cheaper hakshop.com/products/throwing-star-lan-tap – Pythonic Feb 15 '17 at 18:01
  • Build a transparent bridging firewall. This can be done with linux or openbsd. – thrig Feb 24 '17 at 15:12