Re: Port Mirroring in Linux

Hello,

David Schwartz a écrit :
On Oct 30, 5:07 am, jeniffer <zenith.of.perfect...@xxxxxxxxx> wrote:

I need a behavior where I say that all packets coming and going on an
interface X must be given to another interface Y.

That's what a bridge does. As you said above, it looks at its table's
entry and decides which interfaces to forward a packet to.

You are saying:

1) A bridge takes a packet and forwards it onto the appropriate
interfaces.

2) I want to take packets and forward them to appropriate interfaces.

But I'm afraid that the OP and a bridge have a slightly different idea of what "appropriate interfaces" is. To a bridge, it is interfaces that have seen incoming traffic from the destination MAC address, or all interfaces if the destination is unknown or broadcast (I skip the multicast case). To the OP, it is the same *plus* the mirroring interface.

3) I don't want a bridge.

You do realize that bridges frequently send the same packet to more
than one destination. Consider the obvious case where the bridge has
never seen a packet with that destination MAC before. Consider an ARP
request.

What you want is what bridges do.

I do not think that the vanilla Linux bridge code can do what the OP wants. I guess it could if learning could be disabled, so the bridge floods all traffic on all interfaces.
.

Relevant Pages

  • Re: distributed bridging [script]
    ... >> I'm trying to create a configuration that would bridge interfaces on ... Each host would have at least two interfaces, ... here's a completely untested script. ...
    (freebsd-net)
  • Re: TUN/TAP hacking
    ... The Linux kernel networking folks hang out at netdev ... both interfaces different IPv4 addresses, ... Both logs from my bridge program and tcpdump tell me that the packets ... Is it simply that the stack inconditionally drops any packet with the same ...
    (Linux-Kernel)
  • Re: bridge with access on both interfaces
    ... >>'inside' and 'outside' IPs separately on each bridge interface, ... Some tcpdumps on both in and outside interfaces suggest an ARP ... > If you want to use IP while bridging, ... and net4801 is that the 3 ethernet controllers now share one interrupt. ...
    (freebsd-net)
  • Re: Bridge, dpcpd, sshd
    ... I have a server machine that I use as DHCP server, ... interfaces on it, I would like to use two of those for the ... I set up a bridge interface as per the FreeBSD ... If I manually start dhcpd with the same parameters ...
    (freebsd-questions)
  • [BUG][debian-2.6.20-1-686] bridging + vlans + "vconfig rem" == stuck kernel
    ... I've managed to fairly reliably trigger a deadlock in some portion of the linux networking code on my Debian test box. ... I'm pretty sure that it's a race condition of some sort as it doesn't trigger if I ifdown the interfaces one by one, but if I run "ifdown -a" then it triggers halfway through reliably. ... Just for a bit of background on why this is so complex: When I get this networking problem sorted out I'm going to set up heartbeat and a dummy "world1" interface with a shared MAC which is added to the "world" bridge when the current system is the DHCP-client master. ...
    (Linux-Kernel)