Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to build a silent bridge for monitoring purpose. My computer is running linux 2.6, brctl 1.4 and has 3 NIC:
eth0, with an assigned IP, used for SSH maintenance
eth1, and eth2 , the 2 ports of the bridge br0

all is set in etc/network/interfaces :

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 192.168.1.120
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.254

auto br0
iface br0 inet manual
        bridge_ports eth1 eth2
        bridge_maxwait 0
        bridge_stp off

This way, both eth0 and eth1 are connected to my local network.(eth2 being connected to my gateway) But only eth0 has an IP addr.

The bridge is working just fine, and I can monitor traffic using tcpdump -i br0, or other tools.

Since the bridge has no ip address, it should not emit any traffic. However, it sometimes answers to arp request, instead of eth0.

assuming eth0 has 00:01:02:ab:00:00 and eth1 has 00:01:02:ab:00:01 for mac address: this is what I get on my local station running wireshark :

packet no time   source    dest   protocol info
    4303  1063.539943 00:01:02:ab:00:01 Giga-Byt_46:d9:fe ARP 192.168.1.120 is at 00:01:02:ab:00:01
    4305  1063.539958 00:01:02:ab:00:00 Giga-Byt_46:d9:fe ARP 192.168.1.120 is at 00:01:02:ab:00:00

Since my 'real' IP interface respond miliseconds later, but it could not be the case... How can I fix this problem ?

share|improve this question
    
Hmm. What happens if you force the br0 interface into promiscuous mode? i.e. 'up ip link set $IFACE promisc on' –  gravyface Nov 26 '10 at 16:33
    
Is it possible to do ip link set br0 arp off? Or is that not possible on bridge devices? –  Steven Monday Nov 26 '10 at 23:52
    
ip link set br0 arp off also work ! I dont know the difference between this and the solution Dom proposed in next answer, except you can only set arp on or off, whereas /proc/sys/net/conf/<interface> gives you more control. –  dev.pollux Nov 27 '10 at 8:42

2 Answers 2

up vote 3 down vote accepted

http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP should help you, if you ask the bridge to not answer to arp requests.

share|improve this answer
    
So in this case you're looking for echo 1 > /proc/sys/net/ipv4/conf/eth0/arp_ignore and echo 8 > /proc/sys/net/ipv4/conf/eth0/arp_announce. These can be put into /etc/sysctl.conf for persistence. –  sysadmin1138 Nov 26 '10 at 17:14
    
This is exactly what I needed :)<br/> echo 8 > /proc/sys/net/ipv4/conf/br0/arp_ignore did stop flase arp responses. Since br0 has no IP, I think I dont need to set arp_announce right ? –  dev.pollux Nov 27 '10 at 8:21

Another option beyond using the /proc/*/arp_ignore is to get rid of the eth0 interface and put the IP address on the bridge:

auto br0
iface br0 inet manual
        bridge_ports eth1 eth2
        bridge_maxwait 0
        bridge_stp off
        address 192.168.1.120
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.254

Personally, I think this simplifies it some conceptually because the interface is then on the bridge directly.

share|improve this answer
    
It could work, But I'd like to keep admin interface and monitoring interface distinct. that way, I can listen on a different network (ie the other side of my router) without have to reconfigure anything. –  dev.pollux Nov 27 '10 at 8:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.