We have an internet connection that we need to audit:
INTERNET ->> ROUTER ->> CLIENTS
our idea would be to put a (enough big) HUB before the router (router, that logs in via pppoe to the ISP) and on that HUB put an OpenBSD* machine too:
INTERNET ->> HUB ->> ROUTER ->> CLIENTS
*I want to run a:
tcpdump -i em0 -w out.pcap
on the OpenBSD machine (em0 is the interface plugged in to the HUB, -no IP address needed for that interface?). I choosed OpenBSD since it has a history regarding security, so if there is an attacker, it wont go in via tcpdump, since tcpdump could have vulnerabilities, and it listens on the interface.
My question: is this the perfect solution? (no, I don't trust proprietary HW that can do "port mirroring")
UPDATE: We don't want to put an iptables rule in the router to send all traffic to a logserver.