I am trying to set up a URL filtering product (Elron's Web Inspector) that needs to see all outbound traffic to the internet, and reply to the requester with a spoofed packet for blocked URLs. In order to monitor outbound traffic, I have to set up a SPAN port, which would block the spoofed reply packet from the URL filter. Any ideas on a workaround? My current options are to put two NICs in the Web Inspector box, or put a FastEthernet Hub (Half-Duplex) directly between the switch and internet router.
I am using native mode on a 6509.