From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rogers.com; s=s2048; t=1424122562; bh=JjQog4wnnFQNrwOmq1EFa0jtaR3bVAHSvoet2NzchNY=; h=From:To:References:In-Reply-To:Subject:Date:From:Subject; b=sNYuY7n9dHf/4e757eZVQzwsEF2yRntKU3RDeJ7Fb9O00/xSlIaUBRCTzIZbZergVE/ASRpIRBSHpI/oFzmNg0KvuyQmjKka3++v8RFiTp2Y8Md1P2EJrjR6+vkHdLK7rYiQvKGxvgPc8jOBL6MDZVDUhbPK96H+Q3cuvb5aoKjKGMqtE9u//LAAiia61q8iB7gGDoGAAa4ZmvwPTPR8ossf1DOE7tcUF1XS6DdAnMyoNa9MpOzxoFzYqagn/ltRS/ZAqRyVXxL7BFA4sp/C/+TChICxvVnYtkKhDfSu6+SjT3Z9A5643/nQ4CLT2/kXX1c5tZliD1VxhRaGBzaQ0A== From: "The Q" References: In-Reply-To: Date: Mon, 16 Feb 2015 16:35:58 -0500 Message-ID: <02f601d04a30$8eb33820$ac19a860$@rogers.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_02F7_01D04A06.A5DDCC60" Content-Language: en-ca Subject: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: bridge@lists.linux-foundation.org This is a multipart message in MIME format. ------=_NextPart_000_02F7_01D04A06.A5DDCC60 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi all Assume that you have a linux bridge with two interfaces eth0 and eth1 enslaved to this bridge What is the difference between sniffing the bridge and sniffing its interfaces? tcpdump -i br0 vs tcpdump -i eth0 Thanks MiniME ------=_NextPart_000_02F7_01D04A06.A5DDCC60 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

Hi = all

 

Assume that you have a linux bridge with two = interfaces eth0 and eth1 enslaved to this bridge

What is the difference between sniffing the bridge and = sniffing its interfaces?

 

tcpdump -i = br0   vs tcpdump –i eth0

 

Thanks

MiniME

------=_NextPart_000_02F7_01D04A06.A5DDCC60-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aenertia.net; s=dkimaenertianet; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=PQbL8PWVjRjLsZzzGclaU2MTrBgDWivyLGVgVhJCOgk=; b=ViSelaRS0i8xUydWs1TglbLcJYb9xzAjbh6ETjIE9W/YKtfL3fNo6WcGTO+d3xIzJA KKP7Y70acT5NPX/F/YRnHPXKHCxpkUF/1rqpuwtCwq/FkDPDBafHdbTwtuHegMDD+1og 0vp0/WC5jPR+yPEFKv7MPGsBJ8eTd1l+agPpY= MIME-Version: 1.0 Sender: aenertia@aenertia.net In-Reply-To: <02f601d04a30$8eb33820$ac19a860$@rogers.com> References: <02f601d04a30$8eb33820$ac19a860$@rogers.com> From: =?UTF-8?Q?Joel_Wir=C4=81mu_Pauling?= Date: Mon, 16 Feb 2015 16:17:30 -0600 Message-ID: Content-Type: multipart/alternative; boundary=001a11c32d18f1ad0b050f3bf482 Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: The Q Cc: "bridge@lists.linux-foundation.org" --001a11c32d18f1ad0b050f3bf482 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I can think of several potential differences. =E2=80=8BYou may miss any bri= dge specific traffic (STP, LLDP) using the interfaces generated by the bridge itself. If you have vlan tagged sub interfaces you might also miss that traffic if you were snooping a particular interface. Obviously you will miss any on-wire broadcast traffic specific to the layer1 connection a particular interface was connected to if you sniff on an individual device. Basically unless you are trying to trouble shoot a physical link issue I would likely always use the container link when doing a packet dump, due to several edge cases. If your bridge node host is participating (i.e has an IP etc on the br0 device itself , rather than in the case of a container for Vtap's/Virtual machine nics') You would also miss the hypervisors/hosts traffic if you sniffed the contained nics. -Joel On 16 February 2015 at 15:35, The Q wrote: > > > Hi all > > > > Assume that you have a linux bridge with two interfaces eth0 and eth1 > enslaved to this bridge > > What is the difference between sniffing the bridge and sniffing its > interfaces? > > > > tcpdump -i br0 vs tcpdump =E2=80=93i eth0 > > > > Thanks > > MiniME > --001a11c32d18f1ad0b050f3bf482 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I can think of several potential differences. =E2=80=8BYou may = miss any bridge specific traffic (STP, LLDP) using the interfaces generated= by the bridge itself.

If you have vlan tagged sub interfaces you migh= t also miss that traffic if you were snooping a particular interface. Obvio= usly you will miss any on-wire broadcast traffic specific to the layer1 con= nection a particular interface was connected to if you sniff on an individu= al device.=C2=A0

Basically unless you are trying to trouble shoot a ph= ysical link issue I would likely always use the container link when doing a= packet dump, due to several edge cases.=C2=A0

If your bridge node hos= t is participating (i.e has an IP etc on the br0 device itself , rather tha= n in the case of a container for Vtap's/Virtual machine nics') You = would also miss the hypervisors/hosts traffic if you sniffed the contained = nics.


-Joel



<= div class=3D"gmail_quote">On 16 February 2015 at 15:35, The Q <theq@rogers.c= om> wrote:

=C2= =A0

Hi all

=C2=A0

Assume that you hav= e a linux bridge with two interfaces eth0 and eth1 enslaved to this bridge<= u>

What is the difference between snif= fing the bridge and sniffing its interfaces?

=C2=A0

tcpdump -i br0 =C2= =A0=C2=A0vs tcpdump =E2=80=93i eth0

=C2=A0

Thanks

MiniME

=
--001a11c32d18f1ad0b050f3bf482-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: MIME-Version: 1.0 In-Reply-To: References: <02f601d04a30$8eb33820$ac19a860$@rogers.com> Date: Mon, 16 Feb 2015 17:28:50 -0500 Message-ID: From: Stephen Hemminger Content-Type: multipart/alternative; boundary=001a1135467a4d038e050f3c1cf5 Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: =?UTF-8?Q?Joel_Wir=C4=81mu_Pauling?= Cc: The Q , bridge --001a1135467a4d038e050f3c1cf5 Content-Type: text/plain; charset=UTF-8 Sniffing on bridge only shows traffic destined for the Mac address of the bridge device. Whereas sniffing on a physical device will show all traffic going over that device. --001a1135467a4d038e050f3c1cf5 Content-Type: text/html; charset=UTF-8

Sniffing on bridge only shows traffic destined for the Mac address of the bridge device.

Whereas sniffing on a physical device will show all traffic going over that device.

--001a1135467a4d038e050f3c1cf5-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rogers.com; s=s2048; t=1424126394; bh=yAGhWnY5f4Wm2WW9052vCCw0qF69226qIR8Tr5yYheY=; h=From:To:Cc:References:In-Reply-To:Subject:Date:From:Subject; b=ZtINSpe//v2Ma0DOG3iKhAs9e5S2dRUYYdbWDGBvaP9Q5HFb4Kz8+s4ix98zce1WFl1Du3vZuPDWDsUy3vWrZ1AfDQSwBpv638dlOGD6cxzeCn7z0g4P60GbCiHlvZPwN7xfTXUld8xHSF2XVsXEhKnJL29dheXBVJnUhruN81MxAVcexkiKjDzDHTQRP9Ze+ch2KZg0P4psmIrvHLPx2mmBbAcnagnoME3O48KEoCD0RxbiDDZejL7kwazdsXMzkZzurw4dSRzJDtkAL13gVpXDPI0J8JSzmpqsHZegzClRkj5Fe/ELkDfhTjE6bbIzIrYAiHyxJ12qBLBeilwY3w== From: "Q" References: <02f601d04a30$8eb33820$ac19a860$@rogers.com> In-Reply-To: Date: Mon, 16 Feb 2015 17:39:49 -0500 Message-ID: <031001d04a39$7a1e45e0$6e5ad1a0$@rogers.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0311_01D04A0F.914DBC20" Content-Language: en-ca Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: =?UTF-8?Q?'Joel_Wir=C4=81mu_Pauling'?= Cc: bridge@lists.linux-foundation.org This is a multipart message in MIME format. ------=_NextPart_000_0311_01D04A0F.914DBC20 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Joel I have the feeling that you are using developer terms which I = don=E2=80=99t totally udersta I will rephrase what I believe you said below, just to make sure that I = got the idea: =20 Eth0=C3=9F=C3=A0 br0=C3=9F=C3=A0eth1 =20 >From what you are saying if I sniff eth0 only there is chances that I = will miss L1 traffic injected by the host or by the other eth1 If eth0 and eht1 have respectively vlan 1 and vlan 2 the only way to = sniff both simultaneously would be by sniffing br0 There are also L1-L2 packet originated by br0 that might be misses =20 Are these correct? =20 Thanks Q =20 From: aenertia@aenertia.net [mailto:aenertia@aenertia.net] On Behalf Of = Joel Wiramu Pauling Sent: February-16-15 5:17 PM To: The Q Cc: bridge@lists.linux-foundation.org Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved = interfaces =20 I can think of several potential differences. =E2=80=8BYou may miss any = bridge specific traffic (STP, LLDP) using the interfaces generated by = the bridge itself. =20 If you have vlan tagged sub interfaces you might also miss that traffic = if you were snooping a particular interface. Obviously you will miss any = on-wire broadcast traffic specific to the layer1 connection a particular = interface was connected to if you sniff on an individual device.=20 =20 Basically unless you are trying to trouble shoot a physical link issue I = would likely always use the container link when doing a packet dump, due = to several edge cases.=20 =20 If your bridge node host is participating (i.e has an IP etc on the br0 = device itself , rather than in the case of a container for = Vtap's/Virtual machine nics') You would also miss the hypervisors/hosts = traffic if you sniffed the contained nics. =20 =20 -Joel =20 =20 =20 On 16 February 2015 at 15:35, The Q wrote: =20 Hi all =20 Assume that you have a linux bridge with two interfaces eth0 and eth1 = enslaved to this bridge What is the difference between sniffing the bridge and sniffing its = interfaces? =20 tcpdump -i br0 vs tcpdump =E2=80=93i eth0 =20 Thanks MiniME =20 ------=_NextPart_000_0311_01D04A0F.914DBC20 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Thanks Joel

I have the feeling that you are using developer terms which I = don=E2=80=99t totally udersta

I will rephrase what I believe you said below, just to make sure that = I got the idea:

 

Eth0=C3=9F=C3=A0 br0=C3=9F=C3=A0eth1

 

From what you are saying if I sniff eth0 only there is chances that I = will miss L1 traffic injected by the host or by the other = eth1

If eth0 and eht1 have respectively vlan 1 and vlan 2 the only way to = sniff both simultaneously would be by sniffing = br0

There are also L1-L2 packet originated by br0 that might be = misses

 

Are these correct?

 

Thanks

Q

 

From:= = aenertia@aenertia.net [mailto:aenertia@aenertia.net] On Behalf Of = Joel Wiramu Pauling
Sent: February-16-15 5:17 = PM
To: The Q
Cc: = bridge@lists.linux-foundation.org
Subject: Re: [Bridge] = Sniffing a linux bridge vs sniffing enslaved = interfaces

 

I = can think of several potential differences. =E2=80=8BYou may miss any bridge = specific traffic (STP, LLDP) using the interfaces generated by the = bridge itself.

 

=

If you have vlan tagged sub = interfaces you might also miss that traffic if you were snooping a = particular interface. Obviously you will miss any on-wire broadcast = traffic specific to the layer1 connection a particular interface was = connected to if you sniff on an individual = device. 

 

=

Basically unless you are = trying to trouble shoot a physical link issue I would likely always use = the container link when doing a packet dump, due to several edge = cases. 

 

=

If your bridge node host is = participating (i.e has an IP etc on the br0 device itself , rather than = in the case of a container for Vtap's/Virtual machine nics') You would = also miss the hypervisors/hosts traffic if you sniffed the contained = nics.

 

=

 

=

-Joel

<= /div>

 

=

 

=

 

On 16 February 2015 at 15:35, The Q <theq@rogers.com> = wrote:

 <= /o:p>

Hi = all

 <= /o:p>

Assume that = you have a linux bridge with two interfaces eth0 and eth1 enslaved to = this bridge

What is the = difference between sniffing the bridge and sniffing its = interfaces?

 <= /o:p>

tcpdump -i = br0   vs tcpdump =E2=80=93i eth0

 <= /o:p>

Thanks<= /o:p>

MiniME<= /o:p>

 

------=_NextPart_000_0311_01D04A0F.914DBC20--