this can be done easily with pf using the dup-to flag of a match statement. using a span port or other physical network tap would probably be a better solution

this can be done easily with pf using the dup-to flag of a match statement. using a span port or other physical network tap would probably be a better solution than these things in production, though.