* [Bridge] Trouble with ARP traffic
@ 2006-08-30 15:08 Raffaele Carla
0 siblings, 0 replies; 5+ messages in thread
From: Raffaele Carla @ 2006-08-30 15:08 UTC (permalink / raw)
To: bridge
[-- Attachment #1: Type: text/plain, Size: 3073 bytes --]
Hi,
I've setup a Linux (SUSE v. 2.6.16.13-4-smp) in bridging mode. The br0
interface has two physical: eth0 and eth1.
The eth0 interface is connected to our LAN, the eth1 is connected to a
SONICWALL firewall. STP is turned off, since it's the only bridge connecting
the two areas.
The bridge is also acting filtering some traffic via iptables.
All is working fine, but when I use tcpdump on the eth1 interface, I see all
the ARP requests of the LAN. In other words, the entirely ARP broadcasts
(that will be resolved internally) are passing the bridge and reaching the
firewall.
As a bridge, the Linux box should be aware where every machine is located
and separate logically the two segments, shouldn't it?
Also, the command "arp -a" shows only one address, wether the "brctl
showmacs br0" shows all the addresses correctly. Is this a normal
behaviour?
Thank you for every advice,
Raffaele
Output of brctl showstp br0
---------------------------------------
br0
bridge id 8000.001560a34be7
designated root 8000.001560a34be7
root port 0 path cost 0
max age 20.00 bridge max age
50.00
hello time 2.00 bridge hello time
5.00
forward delay 37.50 bridge forward delay
15.00
ageing time 300.01
hello timer 1.39 tcn timer
0.00
topology change timer 0.00 gc timer
0.05
flags
eth0 (1)
port id 8001 state
forwarding
designated root 8000.001560a34be7 path cost 19
designated bridge 8000.001560a34be7 message age timer
0.00
designated port 8001 forward delay timer
0.00
designated cost 0 hold timer
0.39
flags
eth1 (2)
port id 8002 state
forwarding
designated root 8000.001560a34be7 path cost 100
designated bridge 8000.001560a34be7 message age timer
0.00
designated port 8002 forward delay timer
0.00
designated cost 0 hold timer
0.39
flags
Output of brctl showmacs br0
------------------------------------------
1 00:04:23:0a:a6:13 no 86.16
1 00:04:75:4c:d7:03 no 5.06
1 00:04:75:87:bd:a9 no 138.51
1 00:04:76:a3:c9:b8 no 100.12
2 00:06:b1:11:8d:a4 no 0.07
1 00:0f:20:3b:8e:4e no 41.11
1 00:0f:20:3b:fe:57 no 60.78
1 00:14:69:b4:49:84 no 0.14
1 00:15:60:a3:4b:e7 yes 0.00
1 00:30:c1:5f:24:56 no 28.16
1 00:30:c1:8c:e7:61 no 39.05
2 00:c0:f0:56:51:c6 yes 0.00
[-- Attachment #2: Type: text/html, Size: 18192 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bridge] Trouble with ARP traffic
@ 2006-08-31 16:45 Raffaele Carla
2006-08-31 17:03 ` Stephen Hemminger
2006-08-31 17:31 ` Boris Dorès
0 siblings, 2 replies; 5+ messages in thread
From: Raffaele Carla @ 2006-08-31 16:45 UTC (permalink / raw)
To: bridge
[-- Attachment #1: Type: text/plain, Size: 3197 bytes --]
Hi,
I've setup a Linux (SUSE v. 2.6.16.13-4-smp) in bridging mode. The br0
interface has two physical: eth0 and eth1.
The eth0 interface is connected to our LAN, the eth1 is connected to a
SONICWALL firewall. STP is turned off, since it's the only bridge
connecting the two areas. The bridge is also filtering some traffic via
iptables.
All is working fine, but when I use tcpdump on the eth1 interface, I see
all the ARP requests of the LAN. In other words, the entirely ARP
broadcasts (that will be resolved internally) are passing the bridge and
reaching the firewall.
As a bridge, the Linux box should be aware where every machine is located
and separate logically the two segments, shouldn't it?
Also, the command "arp –a" shows only one address, wether the "brctl
showmacs br0" shows all the addresses correctly. Is this a normal
behaviour?
Thank you for any advice,
Raffaele
Output of brctl showstp br0
---------------------------------------
br0
bridge id 8000.001560a34be7
designated root 8000.001560a34be7
root port 0 path cost
0
max age 20.00 bridge max age
50.00
hello time 2.00 bridge hello
time 5.00
forward delay 37.50 bridge forward delay
15.00
ageing time 300.01
hello timer 1.39 tcn timer
0.00
topology change timer 0.00 gc
timer 0.05
flags
eth0 (1)
port id 8001
state forwarding
designated root 8000.001560a34be7 path
cost 19
designated bridge 8000.001560a34be7 message age
timer 0.00
designated port 8001 forward delay
timer 0.00
designated cost 0 hold
timer 0.39
flags
eth1 (2)
port id 8002
state forwarding
designated root 8000.001560a34be7 path
cost 100
designated bridge 8000.001560a34be7 message age
timer 0.00
designated port 8002 forward delay
timer 0.00
designated cost 0 hold
timer 0.39
flags
Output of brctl showmacs br0
------------------------------------------
1 00:04:23:0a:a6:13 no 86.16
1 00:04:75:4c:d7:03 no 5.06
1 00:04:75:87:bd:a9 no 138.51
1 00:04:76:a3:c9:b8 no 100.12
2 00:06:b1:11:8d:a4 no 0.07
1 00:0f:20:3b:8e:4e no 41.11
1 00:0f:20:3b:fe:57 no 60.78
1 00:14:69:b4:49:84 no 0.14
1 00:15:60:a3:4b:e7 yes 0.00
1 00:30:c1:5f:24:56 no 28.16
1 00:30:c1:8c:e7:61 no 39.05
2 00:c0:f0:56:51:c6 yes 0.00
[-- Attachment #2: Type: text/html, Size: 8981 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Bridge] Trouble with ARP traffic
2006-08-31 16:45 [Bridge] Trouble with ARP traffic Raffaele Carla
@ 2006-08-31 17:03 ` Stephen Hemminger
2006-08-31 17:31 ` Boris Dorès
1 sibling, 0 replies; 5+ messages in thread
From: Stephen Hemminger @ 2006-08-31 17:03 UTC (permalink / raw)
To: Raffaele Carla; +Cc: bridge
On Thu, 31 Aug 2006 12:45:44 -0400
"Raffaele Carla" <raffaele.carla@gmail.com> wrote:
> Hi,
>
> I've setup a Linux (SUSE v. 2.6.16.13-4-smp) in bridging mode. The br0
> interface has two physical: eth0 and eth1.
>
> The eth0 interface is connected to our LAN, the eth1 is connected to a
> SONICWALL firewall. STP is turned off, since it's the only bridge
> connecting the two areas. The bridge is also filtering some traffic via
> iptables.
>
> All is working fine, but when I use tcpdump on the eth1 interface, I see
> all the ARP requests of the LAN. In other words, the entirely ARP
> broadcasts (that will be resolved internally) are passing the bridge and
> reaching the firewall.
>
> As a bridge, the Linux box should be aware where every machine is located
> and separate logically the two segments, shouldn't it?
>
The bridge is at lower level, and only looks at the Ethernet header and
those packets are broadcast's so they have to be flood routed. You could
run a proxy arp daemon and filter out arp with ebtables.
> Also, the command "arp –a" shows only one address, wether the "brctl
> showmacs br0" shows all the addresses correctly. Is this a normal
> behaviour?
>
> Thank you for any advice,
>
> Raffaele
>
>
> Output of brctl showstp br0
> ---------------------------------------
>
> br0
> bridge id 8000.001560a34be7
> designated root 8000.001560a34be7
> root port 0 path cost
> 0
> max age 20.00 bridge max age
> 50.00
> hello time 2.00 bridge hello
> time 5.00
> forward delay 37.50 bridge forward delay
> 15.00
> ageing time 300.01
> hello timer 1.39 tcn timer
> 0.00
> topology change timer 0.00 gc
> timer 0.05
> flags
>
> eth0 (1)
> port id 8001
> state forwarding
> designated root 8000.001560a34be7 path
> cost 19
> designated bridge 8000.001560a34be7 message age
> timer 0.00
> designated port 8001 forward delay
> timer 0.00
> designated cost 0 hold
> timer 0.39
> flags
>
> eth1 (2)
> port id 8002
> state forwarding
> designated root 8000.001560a34be7 path
> cost 100
> designated bridge 8000.001560a34be7 message age
> timer 0.00
> designated port 8002 forward delay
> timer 0.00
> designated cost 0 hold
> timer 0.39
> flags
>
> Output of brctl showmacs br0
> ------------------------------------------
> 1 00:04:23:0a:a6:13 no 86.16
> 1 00:04:75:4c:d7:03 no 5.06
> 1 00:04:75:87:bd:a9 no 138.51
> 1 00:04:76:a3:c9:b8 no 100.12
> 2 00:06:b1:11:8d:a4 no 0.07
> 1 00:0f:20:3b:8e:4e no 41.11
> 1 00:0f:20:3b:fe:57 no 60.78
> 1 00:14:69:b4:49:84 no 0.14
> 1 00:15:60:a3:4b:e7 yes 0.00
> 1 00:30:c1:5f:24:56 no 28.16
> 1 00:30:c1:8c:e7:61 no 39.05
> 2 00:c0:f0:56:51:c6 yes 0.00
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Bridge] Trouble with ARP traffic
2006-08-31 16:45 [Bridge] Trouble with ARP traffic Raffaele Carla
2006-08-31 17:03 ` Stephen Hemminger
@ 2006-08-31 17:31 ` Boris Dorès
1 sibling, 0 replies; 5+ messages in thread
From: Boris Dorès @ 2006-08-31 17:31 UTC (permalink / raw)
To: Raffaele Carla; +Cc: bridge
On Thu, Aug 31, 2006 at 12:45:44PM (GMT-0400), Raffaele Carla wrote:
> As a bridge, the Linux box should be aware where every machine is located
> and separate logically the two segments, shouldn't it?
No. Arp is there to find out where an *IP* address is located. The
bridge doesn't even know what IP is, and therefore transmits arp
exactly like other frames.
> Also, the command "arp –a" shows only one address, wether the "brctl
> showmacs br0" shows all the addresses correctly. Is this a normal
> behaviour?
Yes. "arp -a" lists the addresses that the *host* knows. The bridge
has its own independant database. Not all the frames that pass through
the bridge are transmitted to upper layers, only the ones with the mac
address of the host (and broadcast) are.
--
Boris Dorès
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Bridge] Trouble with ARP traffic
@ 2006-09-01 8:17 Skept
0 siblings, 0 replies; 5+ messages in thread
From: Skept @ 2006-09-01 8:17 UTC (permalink / raw)
To: bridge
Raffaele
If you don't want to see much arp traffic on eth1, assuming that you
have a subnet 10.190.190.0/24, with 10.190.190.1 on eth1 and the rest
of the hosts on eth0, you can use for example, the following filter
ebtables -N f1
ebtables -P f1 DROP
ebtables -t filter -A FORWARD -i eth0 -o eth1 -p ARP -j f1
ebtables -t filter -A f1 -p ARP --arp-ip-src 10.190.190.0/24
--arp-ip-dst 10.190.190.1 -j ACCEPT
That way you wont see much arp broadcast traffic on eth1. Hope it helps.
Skept
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2006-09-01 8:17 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-08-31 16:45 [Bridge] Trouble with ARP traffic Raffaele Carla
2006-08-31 17:03 ` Stephen Hemminger
2006-08-31 17:31 ` Boris Dorès
-- strict thread matches above, loose matches on Subject: below --
2006-09-01 8:17 Skept
2006-08-30 15:08 Raffaele Carla
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox