I have two promiscuous sniffing interfaces on my linux box:
eth0 is connected to an external vlan bridge
eth1 is connected to an internal vlan bridge
with eth0 I can sniff all traffic on my "external network" with eth1 I can sniff all traffic on my "internal network"
I then created a bridge with brctl (br0) and added both interfaces to this bridge.
Now I can sniff all packets showing up on eth1 and eth2 directly from br0 saving me having to launch two instances of snort.
My problem is that now arp and multicast packets that are showing up on eth0 are copied on to br0 and forwarded to eth1.
Is there any way to make both these interfaces copy all packets on to br0 but never allow br0 to forward any packets nor eth0 or eth1 to respond to them?