0

(Originally, I posted it on StackOverflow. I move it to networkengineering and then here.)

I have TP-LINK WR841N v9 router and install OpenWRT firmware CHAOS CALMER (15.05.1, r48532).

I have /etc/config/network content:
config interface 'lan' option force_link '1' option type 'bridge' option proto 'static' option ipaddr '10.15.252.3' option netmask '255.255.254.0' option gateway '10.15.252.1' option ifname 'eth0 eth1'

Here is the output of ip link ls:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UP mode DEFAULT group default qlen 1000 link/ether c4:6e:1f:b6:8e:24 brd ff:ff:ff:ff:ff:ff 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc fq_codel master br-lan state DOWN mode DEFAULT group default qlen 1000 link/ether c4:6e:1f:b6:8e:25 brd ff:ff:ff:ff:ff:ff 4: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether c4:6e:1f:b6:8e:24 brd ff:ff:ff:ff:ff:ff 5: br-lan: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default link/ether c4:6e:1f:b6:8e:24 brd ff:ff:ff:ff:ff:ff

I have two computers cable-connecting to 2 of the 4 LAN ports. Let's say computer A and B.

  1. A keeps pinging B and it works well.
  2. On the router, I use tcpdump to captuer traffic from bridge br-lan: tcpdump -i br-lan -n 'arp or icmp'.

I did see arp traffic, but there are no ICMP traffic.

I tried to setup iptables rules to block traffic to B in both INPUT and output chain, and it's not working.

Here is the output of command brctl and ip:
bridge name bridge id STP enabled interfaces br-lan 7fff.c46e1fb68e24 no eth0 eth1

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 RX: bytes packets errors dropped overrun mcast 63107 580 0 0 0 0 TX: bytes packets errors dropped carrier collsns 63107 580 0 0 0 0 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br-lan state UP mode DEFAULT group default qlen 1000 link/ether c4:6e:1f:b6:8e:24 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 64256004 445450 0 6 0 0 TX: bytes packets errors dropped carrier collsns 8775980 43685 0 0 0 0 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc fq_codel master br-lan state DOWN mode DEFAULT group default qlen 1000 link/ether c4:6e:1f:b6:8e:25 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 4: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether c4:6e:1f:b6:8e:24 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 5: br-lan: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default link/ether c4:6e:1f:b6:8e:24 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 57777761 444757 0 60579 0 0 TX: bytes packets errors dropped carrier collsns 8871188 44499 0 0 0 0 There are surely lots of TX and RX packets on interfaces.

So, my questions are:
1. How to use tcpdump to caputer traffic flow through bridge br-lan? (Bridge works on layer-2 and it is suppose to work, isn't it?)
2. If I want to mirror traffic in/out of computer B to another port(e.g wan port), what should I do? (I tried to use this port-mirroring tool, but it is not working.)

(I want to try ebtables, but I couldn't get it installed on the router due to insufficient space. Also, I couldn't find tool bridge to check the forward DB on the bridge.)

I found another relevant thread: Tcpdump/Iptables on bridge interface without assigned IP address and tcpdump on bridge interface (virbr) does not receive any packets destined for one of its addresses, but it's not working.

  • Bridges learn which MAC addresses are connected to which interfaces, and they only send traffic to the interface where the MAC address is connected. On the other hand, ARP is broadcast, meaning that it is sent to every interface on a bridge. – Ron Maupin Jul 25 '17 at 16:24
  • @RonMaupin TCPDUMP cannot get packets before it sends out to the right "LAN" ports of the router? TCPDUMP picks the packets right after the interface fetches it. – 0xBADBOO Jul 25 '17 at 21:07
  • Don't confuse bridges and routers. Bridges operate at layer-2, and routers operate at layer-3. A WAN interface is a layer-3 interface, but a switch interface is a layer-2 interface. You don't mirror layer-2 traffic to a layer-3 interface. A layer-3 device, e.g. router, strips off the layer-2 fraem to get to the layer-3 packet, and it creates a new frame for the new interface. – Ron Maupin Jul 25 '17 at 21:15
  • @RonMaupin Thanks, got that. Mirroring to WAN interface is not correct. Still, how can I use tcpdump to capture unicast packets flow through the bridge? From the output of ip link command, br-lan is already in PROMISC mode. I starts thinking the TCPDUMP is buggy. – 0xBADBOO Jul 25 '17 at 21:45
  • @RonMaupin Also, there are 4 LAN physical port on the router. But, the ifconfig command-alike only shows 2 physical ports eth1 and eth0, and they are attached to br-lan bridge. I am not an hardware guy, but it really confused me. – 0xBADBOO Jul 25 '17 at 21:50
0

I have reconfigured the router to do the followings:
1. Assign both eth0 and eth1 to bridge br-lan;
2. cable-connect computer B to eth1 port (wan port);
3. In port-mirroring config file, forward traffic from eth1 to IP of A.

Now, I can listen all the traffics in/out of B. And of course, tcpdump can also capture traffic flow through br-lan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.