today I am not writing because of a certain problem or thing I stumbled upon. The “news” I want to share is somewhat “old” (26 August 2013), too: VMware announced vSphere 5.5 and ESXi 5.5!
Why am I posting this? Besides some cool new features in Hardware Version 10 or on the VDP side and Hypervisor side, a mayor change that will affect how we use vCenter in our Company is: Full Mac OS X Client integration (including the plugin for vCenter WebClient).
So, one of our domain printers was acting up and the printer department wanted me to sniff all the packets to and from the printer. So far so good, usually you could use a hub (still got one around? neither do I), or for example a switch with a monitoring or promiscuous port (not available? Welcome to the club!). Ok, now I could start arp spoofing the printer, but was too lazy to do that, besides: we have intrusion prevention up and running…
Take a good look at your machine. Is it a portable laptop like mine? Does it have any flavor of Unix or Linux on it? Well, so does mine, in this case Apple OS X (10.8.2). There’s got to be a way to bridge two ethernet interfaces, connect myself to the network and let the printer talk to the world through my laptop? You betcha!
Here’s what I did:
grab one of those USB or Thunderbolt Ethernet Adapters
ifconfig // to find out which interface is which
sudo ifconfig en3 up // bring up the USB/Thunderbolt adapter, or it won’t work!
sudo ifconfig bridge0 create
sudo ifconfig bridge0 up
sudo ifconfig bridge0 addm en0 addm en3
sudo sysctl -w net.inet.ip.forwarding=1
It works! Now we can sniff away with tcpdump or wireshark for example, and are sure that no packet is going to escape us…
And to undo what we just did:
sudo ifconfig bridge0 down
sudo ifconfig bridge0 deletem en0 deletem en3
sudo ifconfig bridge0 destroy
sudo sysctl -w net.inet.ip.forwarding=0
Many thanks to Chrissy from netnerds, who set me on the right track with her post about NAT on OS X 🙂