From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rogers.com; s=s2048; t=1424126394; bh=yAGhWnY5f4Wm2WW9052vCCw0qF69226qIR8Tr5yYheY=; h=From:To:Cc:References:In-Reply-To:Subject:Date:From:Subject; b=ZtINSpe//v2Ma0DOG3iKhAs9e5S2dRUYYdbWDGBvaP9Q5HFb4Kz8+s4ix98zce1WFl1Du3vZuPDWDsUy3vWrZ1AfDQSwBpv638dlOGD6cxzeCn7z0g4P60GbCiHlvZPwN7xfTXUld8xHSF2XVsXEhKnJL29dheXBVJnUhruN81MxAVcexkiKjDzDHTQRP9Ze+ch2KZg0P4psmIrvHLPx2mmBbAcnagnoME3O48KEoCD0RxbiDDZejL7kwazdsXMzkZzurw4dSRzJDtkAL13gVpXDPI0J8JSzmpqsHZegzClRkj5Fe/ELkDfhTjE6bbIzIrYAiHyxJ12qBLBeilwY3w== From: "Q" References: <02f601d04a30$8eb33820$ac19a860$@rogers.com> In-Reply-To: Date: Mon, 16 Feb 2015 17:39:49 -0500 Message-ID: <031001d04a39$7a1e45e0$6e5ad1a0$@rogers.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0311_01D04A0F.914DBC20" Content-Language: en-ca Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: =?UTF-8?Q?'Joel_Wir=C4=81mu_Pauling'?= Cc: bridge@lists.linux-foundation.org This is a multipart message in MIME format. ------=_NextPart_000_0311_01D04A0F.914DBC20 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks Joel I have the feeling that you are using developer terms which I = don=E2=80=99t totally udersta I will rephrase what I believe you said below, just to make sure that I = got the idea: =20 Eth0=C3=9F=C3=A0 br0=C3=9F=C3=A0eth1 =20 >From what you are saying if I sniff eth0 only there is chances that I = will miss L1 traffic injected by the host or by the other eth1 If eth0 and eht1 have respectively vlan 1 and vlan 2 the only way to = sniff both simultaneously would be by sniffing br0 There are also L1-L2 packet originated by br0 that might be misses =20 Are these correct? =20 Thanks Q =20 From: aenertia@aenertia.net [mailto:aenertia@aenertia.net] On Behalf Of = Joel Wiramu Pauling Sent: February-16-15 5:17 PM To: The Q Cc: bridge@lists.linux-foundation.org Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved = interfaces =20 I can think of several potential differences. =E2=80=8BYou may miss any = bridge specific traffic (STP, LLDP) using the interfaces generated by = the bridge itself. =20 If you have vlan tagged sub interfaces you might also miss that traffic = if you were snooping a particular interface. Obviously you will miss any = on-wire broadcast traffic specific to the layer1 connection a particular = interface was connected to if you sniff on an individual device.=20 =20 Basically unless you are trying to trouble shoot a physical link issue I = would likely always use the container link when doing a packet dump, due = to several edge cases.=20 =20 If your bridge node host is participating (i.e has an IP etc on the br0 = device itself , rather than in the case of a container for = Vtap's/Virtual machine nics') You would also miss the hypervisors/hosts = traffic if you sniffed the contained nics. =20 =20 -Joel =20 =20 =20 On 16 February 2015 at 15:35, The Q wrote: =20 Hi all =20 Assume that you have a linux bridge with two interfaces eth0 and eth1 = enslaved to this bridge What is the difference between sniffing the bridge and sniffing its = interfaces? =20 tcpdump -i br0 vs tcpdump =E2=80=93i eth0 =20 Thanks MiniME =20 ------=_NextPart_000_0311_01D04A0F.914DBC20 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Thanks Joel

I have the feeling that you are using developer terms which I = don=E2=80=99t totally udersta

I will rephrase what I believe you said below, just to make sure that = I got the idea:

 

Eth0=C3=9F=C3=A0 br0=C3=9F=C3=A0eth1

 

From what you are saying if I sniff eth0 only there is chances that I = will miss L1 traffic injected by the host or by the other = eth1

If eth0 and eht1 have respectively vlan 1 and vlan 2 the only way to = sniff both simultaneously would be by sniffing = br0

There are also L1-L2 packet originated by br0 that might be = misses

 

Are these correct?

 

Thanks

Q

 

From:= = aenertia@aenertia.net [mailto:aenertia@aenertia.net] On Behalf Of = Joel Wiramu Pauling
Sent: February-16-15 5:17 = PM
To: The Q
Cc: = bridge@lists.linux-foundation.org
Subject: Re: [Bridge] = Sniffing a linux bridge vs sniffing enslaved = interfaces

 

I = can think of several potential differences. =E2=80=8BYou may miss any bridge = specific traffic (STP, LLDP) using the interfaces generated by the = bridge itself.

 

=

If you have vlan tagged sub = interfaces you might also miss that traffic if you were snooping a = particular interface. Obviously you will miss any on-wire broadcast = traffic specific to the layer1 connection a particular interface was = connected to if you sniff on an individual = device. 

 

=

Basically unless you are = trying to trouble shoot a physical link issue I would likely always use = the container link when doing a packet dump, due to several edge = cases. 

 

=

If your bridge node host is = participating (i.e has an IP etc on the br0 device itself , rather than = in the case of a container for Vtap's/Virtual machine nics') You would = also miss the hypervisors/hosts traffic if you sniffed the contained = nics.

 

=

 

=

-Joel

<= /div>

 

=

 

=

 

On 16 February 2015 at 15:35, The Q <theq@rogers.com> = wrote:

 <= /o:p>

Hi = all

 <= /o:p>

Assume that = you have a linux bridge with two interfaces eth0 and eth1 enslaved to = this bridge

What is the = difference between sniffing the bridge and sniffing its = interfaces?

 <= /o:p>

tcpdump -i = br0   vs tcpdump =E2=80=93i eth0

 <= /o:p>

Thanks<= /o:p>

MiniME<= /o:p>

 

------=_NextPart_000_0311_01D04A0F.914DBC20--