Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small server with a single NIC that I am trying to get a bridge functioning on so that I can run KVM. On this NIC I have a couple IPs statically assigned to it:

eth0 =
eth0:1 =
eth0:2 =
eth0:3 -> Assign the bridge to this

I am attempting to set up a bridge using the following instructions:

sudo brctl addbr br0
sudo brctl addif br0 eth0:3
sudo ifconfig br0 netmask up
sudo route add -net netmask br0
sudo route add default gw br0
sudo tunctl -b -u root -t tap0 > /dev/null
sudo ifconfig tap0 up
sudo brctl addif br0 tap0

However, when I do the second command:

sudo brctl addif br0 eth0:3

It puts the ENTIRE eth0 device into promiscuous mode. This knocks the server offline and inaccessible by anything other than locally.

Is there a way to bridge JUST eth0:3 to br0 and not put the entire device into promiscuous mode?

share|improve this question
up vote 6 down vote accepted

The short answer is, as far as I know, NO.

The long answer: A bridge is a layer 2 device. Think of it as a virtual Switch. To bridge between a network card and an internal device you need to take all data that comes in on the network card and put it on the bridge (minus layer 2 filtering, such as .1q vlans). Let me draw a picture to explain:

This is how you want it to work (a routing scenario):

<vif> ---- <br0> --- <eth0:3> ---- <peth0> --- <internet>

But in reality the virtual bridge always bridges on layer 2:

<br0> --- <peth0>-------<internet>
  |          |
<vif0>    <eth0>

Here peth0 is your physical device, while eth0 is the logical device (with address and such).

To get the scenario you want you will have to use routing instead of bridges. The reason that peth0 is put in promiscious mode is because it could otherwise filter out data headed to devices on the bridge. It doesn't know what the devices on the bridge might listen to.

share|improve this answer
+1 for awesome text-based picture! – violet Apr 7 '10 at 12:32

Nope, I'm pretty sure it won't work that way. You'll need to put the entire eth0 device into the bridge and add subinterfaces to the bridge interface instead, such as br0:1 etc.

Is there any reason that you're trying to avoid having the additional IPs bound on the br0 interface?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.