In an effort to demonstrate how you could create a poor-man's network tap or bridge, I thought I would share how you can create your own using a host with two network interfaces. In this case, I used two Ethernet NICs.

For this to be accomplished you must install brtcls or bridge-utils, ebtables and have Wireshark/tcpdump installed. Then two bridge the two interfaces, you must create the bridge, add the interfaces to it, alter the routes, enable IP forwarding and add ebtable rules.

Brctl is the basic bridge command that sets up the software bridge and ip_forward allows simple forwarding, and ebtables filters layer 2 traffic. Assuming that you are on the 192.168.7.x network and 192.168.7.1 is your gateway address - create a configuration that looks like this: Gateway -> LAN -> (eth0) Bridge Host (eth1)-> Second Host. Then from the second host run a continuous ping aimed at the gateway.

Then install bridge utils and ebtables on the Bridge Host and then create a BASH script that contains the following:

Then use chmod a+x to give your script execute permissions and execute it as sudo or root. You should now see your pings become successful and you are now able to monitor traffic over the bridge interface.