Re: Port Mirroring in Linux

Pascal Hambourg wrote:

Markus Rehbach a écrit :
Pascal Hambourg wrote:

As far as I can see from a quick test, setting the bridge
ageing time to zero (brctl setageingtime <brname> 0) seems to disable
learning, but the bridge still knows its own MAC addresses, so traffic
received on a port destined to one of these MAC address won't be
forwarded to other ports.

True but you could do thomething like this:

ebtables -t nat -A PREROUTING -i eth3 -p 0x0800 -j dnat --to-destination
00:01:12:12:12:12 --dnat-target ACCEPT

How is this supposed to help ?

That'll will redirect all IP (0x0800) traffic to MAC 00:01:12:12:12:12 (which
will be the MAC of other NIC), similar to the DNAT in iptables. But won't this
kill the communication, I mean instead of letting packets go to their preset
destination, this command will alter the destination. So this won't help.

HTH
--
Ashish Shukla
http://wahjava.wordpress.com/
.

Relevant Pages

  • Re: Problem with etherchannel between 2 3550 FXs
    ... :I have a 3550's in different buildings with ~2km of multimode fiber between ... and destination MAC addresses. ... of the final bits of each of the source and destination ... You get to choose which logical operation you want, ...
    (comp.dcom.sys.cisco)
  • Re: Problem with etherchannel between 2 3550 FXs
    ... > and destination MAC addresses. ... > of the final bits of each of the source and destination ... > You get to choose which logical operation you want, ... > provided you aren't fragmenting packets; ...
    (comp.dcom.sys.cisco)
  • Re: ARP requests on my net?
    ... But my machine is not configured to be a router, bridge, or gateway. ... But why would it need the MAC for the router? ... my machine is the destination IP. ... only for passing along to another device closer to the destination ...
    (Fedora)
  • Re: Ip forwarding
    ... Packets that are meant to be forwarded by a router must be sent to its MAC address on the link. ... The gateway column optionnally contains the address of the next hop router if the destination is not directly reachable on the network attached to the output interface. ... In both cases the packet is sent on the link to the next hop MAC address. ...
    (comp.os.linux.networking)
  • Re: Port Mirroring in Linux
    ... learning, but the bridge still knows its own MAC addresses, so traffic ... destination, this command will alter the destination. ... Unless it is set in promiscuous mode, the bridge interface will ignore packets originally addressed to it if their destination MAC address is altered. ... the original destination MAC address is lost although one willing to do port mirroring may considered it a valuable information. ...
    (comp.os.linux.networking)