I have a span feed coming in on an un-addressed interface of a linux (centos) box. eth4. The span contains several vlans.

I have an application which can grab packets from an interface promiscuously, but let's just say that the application isn't able to filter by vlan.

What I'd like to figure out a way to do -- and how is the real question -- is take the traffic off the interface and filter it down to just one vlan and present that limited amount of traffic back to the operating system as an "interface" that could be treated like eth4 is now.

Something like tcpdump -nn -i eth4 vlan 345 -w - | ... but rather than piping that out to another command I need to present that to my application as an interface.

Also, ideally this trick would just copy the packets or better yet pointers to those packets in memory ... rather than recreating them as there will be some performance considerations.


If I understand your goal correctly, you need to do two things:

  1. Create your VLAN interfaces for all the VLAN's coming in eth4 (vconfig add eth4 345 adds a virtual interface eth4.345 which only would carry traffic from vlan 345)

  2. If you need to do this for more than one vlan but expose as a single interface, create a bridged interface (brctl addbr br0), and enslave all those eth4.XXX interfaces to that bridge interface (brctl addif br0 eth4.345; brctl addif br0 eth4.999). Make sure that traffic is not actually forwarded between the interfaces by the bridging code by setting up a generic L2 "drop" filter (ebtables -P FORWARD DROP).

You haven't given us any details about your distribution etc so the specifics of how to do those 2 things will need to be left to Google for you.

| improve this answer | |
  • It should be noted that the Linux vlan implementation does not copy frame data for vconfig-created interfaces – the-wabbit Jun 19 '13 at 9:29
  • Thanks, that's just the kind of guidance I needed. I was waaay overthinking things, this points me in the right direction to do the rest. Thank you for taking the time to answer. – jg3 Jun 19 '13 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.