3

I'm trying to build a silent bridge for monitoring purpose. My computer is running linux 2.6, brctl 1.4 and has 3 NIC:
eth0, with an assigned IP, used for SSH maintenance
eth1, and eth2 , the 2 ports of the bridge br0

all is set in etc/network/interfaces :

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 192.168.1.120
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.254

auto br0
iface br0 inet manual
        bridge_ports eth1 eth2
        bridge_maxwait 0
        bridge_stp off

This way, both eth0 and eth1 are connected to my local network.(eth2 being connected to my gateway) But only eth0 has an IP addr.

The bridge is working just fine, and I can monitor traffic using tcpdump -i br0, or other tools.

Since the bridge has no ip address, it should not emit any traffic. However, it sometimes answers to arp request, instead of eth0.

assuming eth0 has 00:01:02:ab:00:00 and eth1 has 00:01:02:ab:00:01 for mac address: this is what I get on my local station running wireshark :

packet no time   source    dest   protocol info
    4303  1063.539943 00:01:02:ab:00:01 Giga-Byt_46:d9:fe ARP 192.168.1.120 is at 00:01:02:ab:00:01
    4305  1063.539958 00:01:02:ab:00:00 Giga-Byt_46:d9:fe ARP 192.168.1.120 is at 00:01:02:ab:00:00

Since my 'real' IP interface respond miliseconds later, but it could not be the case... How can I fix this problem ?

3
  • Hmm. What happens if you force the br0 interface into promiscuous mode? i.e. 'up ip link set $IFACE promisc on'
    – gravyface
    Nov 26, 2010 at 16:33
  • Is it possible to do ip link set br0 arp off? Or is that not possible on bridge devices? Nov 26, 2010 at 23:52
  • ip link set br0 arp off also work ! I dont know the difference between this and the solution Dom proposed in next answer, except you can only set arp on or off, whereas /proc/sys/net/conf/<interface> gives you more control.
    – dev.pollux
    Nov 27, 2010 at 8:42

2 Answers 2

4

http://kb.linuxvirtualserver.org/wiki/Using_arp_announce/arp_ignore_to_disable_ARP should help you, if you ask the bridge to not answer to arp requests.

2
  • So in this case you're looking for echo 1 > /proc/sys/net/ipv4/conf/eth0/arp_ignore and echo 8 > /proc/sys/net/ipv4/conf/eth0/arp_announce. These can be put into /etc/sysctl.conf for persistence.
    – sysadmin1138
    Nov 26, 2010 at 17:14
  • This is exactly what I needed :)<br/> echo 8 > /proc/sys/net/ipv4/conf/br0/arp_ignore did stop flase arp responses. Since br0 has no IP, I think I dont need to set arp_announce right ?
    – dev.pollux
    Nov 27, 2010 at 8:21
1

Another option beyond using the /proc/*/arp_ignore is to get rid of the eth0 interface and put the IP address on the bridge:

auto br0
iface br0 inet manual
        bridge_ports eth1 eth2
        bridge_maxwait 0
        bridge_stp off
        address 192.168.1.120
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.254

Personally, I think this simplifies it some conceptually because the interface is then on the bridge directly.

1
  • It could work, But I'd like to keep admin interface and monitoring interface distinct. that way, I can listen on a different network (ie the other side of my router) without have to reconfigure anything.
    – dev.pollux
    Nov 27, 2010 at 8:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .