From: grahn+nntp@snipabacken.se   
      
   On Fri, 12 Jun 2009 18:58:18 -0400, Roy Smith  wrote:   
   > In article   
   > <2a86c06c-8192-4bec-b30e-967071ec9213@z20g2000prh.googlegroups.com>,   
   >  dbtouch  wrote:   
   >   
   >> Hi, Jorgen   
   >>   
   >> Thank you for reply. Then is there a way to duplicate a connected   
   >> socket?   
   >   
   > Jorgen's explanation below is exactly correct.  It sounds like what you   
   > want is to have a second process receive a copy of the all the data the   
   > first process sees.  There is no way to do this within the Socket API, for   
   > precisely the reasons Jorgen outlined.   
   >   
   > Jorgen also hinted at what is probably your best best -- use tcpdump, or   
   > perhaps directly access the underlying pcap library directly.   
   >   
   > Another possibility is a hardware solution; use an ethernet bridge which   
   > can mirror packets from one port to another.  Perhaps combined with tcpdump   
   > or pcap, this would allow you to monitor the packet stream on a third   
   > machine (i.e. not the same host as either end of the connection).  Not for   
   > the faint of heart, but perhaps something to be considered.   
      
   And the third possibility is to look again at what you are trying to   
   do and find some drastically different way, or realize that you do not   
   need it at all.   
      
   You are in a situation where you want functionality in the OS which   
   doesn't exist, or exists as primarily a debugging tool (pcap). That is   
   a strong hint that you should look for another solution.   
      
   What is the problem which you want that monitor to solve?   
      
   /Jorgen   
      
   --   
     // Jorgen Grahn           R'lyeh wgah'nagl fhtagn!   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)