On 2019-11-28 15:33, yoav.cohen wrote:
> However, we need to be able to send all TCP traffic to another process
> for offline processing.

This can probably be done using the packet mgmt features of the OS, e.g.
with netfilter/iptables `TEE' for Linux:
http://ipset.netfilter.org/iptables-extensions.man.html#lbDU
or ipf `dup-to' for FreeBSD:
https://www.freebsd.org/cgi/man.cgi?query=ipf&sektion=5&apropos=0&manpath=FreeBSD+12.1-RELEASE+and+Ports

Mirroring the inside interfaces will yield the un-TLS'd traffic.


Patrick
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx