2

Scenario:

  • eth0
    • trunk interface with vlans 10 11 12 13 14 15
    • native vlan on switch configured to 10
  • eth0.11
    • vlan interface, sees any traffic that came in on eth0 tagged with vlan 11
  • ...
  • eth0.15
    • vlan interface, sees any traffic that came in on eth0 tagged with vlan 15

Here's the problem - I want to be able to do a network capture of all traffic on 'eth0' but see ONLY vlan 10 traffic (anything that wasn't tagged).

Right now, a capture on eth0 will give me untagged frames from vlan 10, and tagged frames from vlans 11 through 15.

The workaround has simply been to reconfigure switch to have an unused native vlan on that port, and tag vlan 10, but this makes that ports configuration special/different from all the others. (Think a normal data+voice network port where you have regular traffic on native vlan and tagged frames for voice.) In that case, I'd want to be able to capture data frames, but no voice.

Another related need is when bridging - if I wanted to bridge JUST vlan0 to another port on the linux box - without also bridging all of the tagged frames - the same need would likely come into play.

Is there any way to configure a vlan interface that explicitly sees only the untagged traffic, and not the tagged frames within it?

Improve this question
3
  • Why not just capture everything and then use VLAN filters to filter out data you aren't interested in?
    – EEAA
    Sep 12, 2015 at 15:45
  • Mainly the extra complexity involved for less skilled users that might need to do the capture. Also, using the filters takes that much more overhead on the capture session - especially since the kernel is already doing that filtering internally to pull off frames to the vlan interfaces. Adding permissions to let them use tcpdump/wireshark is trivial though.
    – Nathan Neulinger
    Sep 13, 2015 at 16:35
  • I found some additional information that looks like I might be able to accomplish what I'm looking for by defining a vlan interface with vlan id 0, but haven't found a lot of details on whether that interpretation is correct. (Looking like it does not work that way unfortunately.)
    – Nathan Neulinger
    Sep 13, 2015 at 16:40

1 Answer 1

Reset to default
1

Yes, you can use ebtables to filter out tagged packets. For example, you can use something similar to that:

ebtables -A INPUT -p 802_1Q -j DROP
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .