Re: Port Mirroring in Linux

On Oct 31, 2:41 am, Pascal Hambourg <boite-a-s...@xxxxxxxxxxxxxxx>
wrote:

But I'm afraid that the OP and a bridge have a slightly different idea
of what "appropriate interfaces" is. To a bridge, it is interfaces that
have seen incoming traffic from the destination MAC address, or all
interfaces if the destination is unknown or broadcast (I skip the
multicast case). To the OP, it is the same *plus* the mirroring interface.

A bridge does whatever it's configured to do.

What you want is what bridges do.

I do not think that the vanilla Linux bridge code can do what the OP
wants. I guess it could if learning could be disabled, so the bridge
floods all traffic on all interfaces.

Simply disabling learning will do exactly what the OP wants.

DS

.

Relevant Pages

  • Re: distributed bridging [script]
    ... >> I'm trying to create a configuration that would bridge interfaces on ... Each host would have at least two interfaces, ... here's a completely untested script. ...
    (freebsd-net)
  • Re: bridge with access on both interfaces
    ... >>'inside' and 'outside' IPs separately on each bridge interface, ... Some tcpdumps on both in and outside interfaces suggest an ARP ... > If you want to use IP while bridging, ... and net4801 is that the 3 ethernet controllers now share one interrupt. ...
    (freebsd-net)
  • [BUG][debian-2.6.20-1-686] bridging + vlans + "vconfig rem" == stuck kernel
    ... I've managed to fairly reliably trigger a deadlock in some portion of the linux networking code on my Debian test box. ... I'm pretty sure that it's a race condition of some sort as it doesn't trigger if I ifdown the interfaces one by one, but if I run "ifdown -a" then it triggers halfway through reliably. ... Just for a bit of background on why this is so complex: When I get this networking problem sorted out I'm going to set up heartbeat and a dummy "world1" interface with a shared MAC which is added to the "world" bridge when the current system is the DHCP-client master. ...
    (Linux-Kernel)
  • Re: IPS-Builder
    ... I' d like to share with all, this script made by me based on root0 ... You need 3 network interfaces (One for management and two for the bridge) ... -This have a management interface. ...
    (Focus-IDS)
  • Re: bridge issues with pf rules on OpenBSD/Sparc
    ... > assigned so that clients on the bridged interfaces can access the ... > time, regardless of bridge state. ... > rule pass in on le0 tag t_lan ... > rule pass in on le2 tag t_wap ...
    (comp.unix.bsd.openbsd.misc)