[Bro] Bro (SOC N' a Box) fly-away kit ideas

[Nicholas Weaver]

Another thing which may be useful on the hardware side for this kit:

http://www.dual-comm.com/gigabit_port-mirroring-LAN_switch.htm

These are small, cheap (<$200), USB powered Gigabit switches with a built in mirror: all traffic to/from Port 1 is mirrored to port 4.

I purchased one of these and put it inline in my house as an IDS monitor:  I don't know at which point it starts dropping packets (I didn't test that), but I was able to get it up and running trivially.

This is specifically designed for "incident response" type tapping:  You have a notebook and a network you want to monitor, so you just splice this in with a short ethernet cable.