I'm trying to build a silent bridge for monitoring purpose. My computer is running linux 2.6, brctl 1.4 and has 3 NIC:
eth0, with an assigned IP, used for SSH maintenance
eth1, and eth2 , the 2 ports of the bridge br0
all is set in etc/network/interfaces :
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 192.168.1.120
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.254
auto br0
iface br0 inet manual
bridge_ports eth1 eth2
bridge_maxwait 0
bridge_stp off
This way, both eth0 and eth1 are connected to my local network.(eth2 being connected to my gateway) But only eth0 has an IP addr.
The bridge is working just fine, and I can monitor traffic using tcpdump -i br0, or other tools.
Since the bridge has no ip address, it should not emit any traffic. However, it sometimes answers to arp request, instead of eth0.
assuming eth0 has 00:01:02:ab:00:00 and eth1 has 00:01:02:ab:00:01 for mac address: this is what I get on my local station running wireshark :
packet no time source dest protocol info
4303 1063.539943 00:01:02:ab:00:01 Giga-Byt_46:d9:fe ARP 192.168.1.120 is at 00:01:02:ab:00:01
4305 1063.539958 00:01:02:ab:00:00 Giga-Byt_46:d9:fe ARP 192.168.1.120 is at 00:01:02:ab:00:00
Since my 'real' IP interface respond miliseconds later, but it could not be the case... How can I fix this problem ?
ip link set br0 arp off
? Or is that not possible on bridge devices?