透明地将 http 流量克隆到同一服务器上的另一个端口

Question

I am experimenting with following setup.

1. Clone/copy (but not redirect) all incoming HTTP requests from port 80 to another port say 8080 on same machine. I have a simple NGINX + Lua based WAF which is listening on 8080. Essentially, I am running two instances of webservers here, one which is serving real requests and other one working on cloned traffic for detection purpose. I don't care about being able to block the malicious requests so I dont care about being inline.

2. I want to use WAF only for detection purpose ie it should analyze all incoming requests, raise alert and drop the request after that. This will not hamper anything from users point of view since port 80 is serving real requests.

3. How can I clone traffic this way and just discard it after analysis is done ? Is this feasible ? If yes, please suggest any tools which can clone traffic with minimal performance hit.

2.

Answer 1

Have a look : https://github.com/buger/gor

Example instructions are straightforward. Additional logging or certain forwards you could possibly add as well

Answer 2

In the current Nginx version, there is an ngx_http_mirror_module , which retranslates requests to another endpoint and ignores responses. See also this answer