4

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. Therefore traffic never reaches my NFQUEUE. (if I take one packet and I use Scapy to manually replace the destination MAC address with my host MAC address, it works)

It doesn't works with the mirrored port even with an iptable rules that apply as soon as possible in the filtering pipeline:

iptables -A PREROUTING -t raw -j NFQUEUE --queue-num 1

As mentioned in some other threads, I tried to create a bridge on my interface and filter traffic using the following commands.

tunctl -u root
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 tap0
brctl setfd br0 0
brctl stp br0 off  
ifconfig br0 up
ifconfig eth0 up 0.0.0.0
ifconfig tap0 up 0.0.0.0
echo 0 > /sys/class/net/br0/bridge/ageing_time
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
iptables -F
iptables -A FORWARD -j NFQUEUE --queue-num 1

But even this solution does not solve my problem. Traffic doesn't go through the bridge because of the bridge-nf-call-iptables directive. However I'm not able to get packets in my queue.

By the way, my kernel version is 3.13.0-32.

I'm looking for any solution that allows to put received packet with random mac address into my NFQUEUE.

Thanks for your help, Julien

1
  • Have you configured eth0 to operate in promiscuous mode? – pepoluan Jan 2 '15 at 7:43
1

Your kernel ignores packages that are not addressed to the local network interfaces. You should change eth0 to promiscuous mode:

ip link set dev eth0 promisc on

You could make this persistent via the network configuration:

Debian

auto eth0
iface eth0 inet manual
    up ifconfig eth0 promisc up
    down ifconfig eth0 promisc down

Redhat

BOOTPROTO=static
DEVICE=eth0
TYPE=Ethernet
PROMISC=yes
...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.