I'd like to build a network tap device, to intercept traffic between my PC and router. Imagine the raspberry pi or similar device, running linux, having two ethernet ports. I plug it in between my router and computer, acting as a simple "switch", relaying traffic between router and PC. I'd like to intercept that traffic, i.e. monitor it and log some data when patterns are matched.
Preferably, it would be great if I could also modify packets. Also preferably, it would be great if my device could be "invisible" in the network, i.e. not detected as a network device standing between router and PC. But if that's not possible, it's ok if it'll be identified as network switch.
I understand this would probably be a non-trivial project, so I'm not expecting full recipes here. I'm looking for some guidance about where to start, what possibilities exist, etc.
Last time I checked Windows was so restrictive in terms of networking that this would probably be impossible to build with Windows device (no matter how many Ethernet ports it would have). Linux, on the other hand, is more capable, but still some folks I asked said that it might not be possible without very serious system programming (messing with kernel, etc.). My coding skills with Linux are limited with Python general-purpose (i.e. not system-level) programming.
So... how (if at all) could this be accomplished? What architecture can you propose for such a device? What do I have to learn in terms of Linux network programming, to build such a project? In short... what do I start with?
About me: I'm senior software engineer (.Net / Web Dev), with "developer-level" (i.e. intermediate) understanding of networking, some experience with Wireshark and similar tools, and very limited experience with Linux.