Howto: Copy/Tee/Clone network traffic using iptables

[bluesmoon]

http://www.bjou.de/blog/2008/05/howto-copyteeclone-network-traffic-using-iptables/

[there]

this can be done easily with pf using the dup-to flag of a match statement.

using a span port or other physical network tap would probably be a better solution than these things in production, though.