Any way to configure a vlan interface to grab ONLY untagged frames?

Any way to configure a vlan interface to grab ONLY untagged frames?

[Nathan Neulinger]

It seems like running 'vconfig add IFACE 0' and using IFACE.0 would do this, but it doesn't actually seem to work that way.

If I capture on IFACE directly, I'd expect to get all traffic, including the tagged frames (with the tag intact). 
Looking to be able to bridge/capture/etc. and specifically only receive the untagged frames that haven't already been 
pulled out into a vlan specific interface.

Is there any way to accomplish this without using ebtables or other similar hacks?

-- Nathan

------------------------------------------------------------
Nathan Neulinger                       nneul@neulinger.org
Neulinger Consulting                   (573) 612-1412

Re: Any way to configure a vlan interface to grab ONLY untagged frames?

[Vlad Yasevich]

On 09/13/2015 12:49 PM, Nathan Neulinger wrote:
> It seems like running 'vconfig add IFACE 0' and using IFACE.0 would do this, but it
> doesn't actually seem to work that way.
> 
> If I capture on IFACE directly, I'd expect to get all traffic, including the tagged frames
> (with the tag intact). Looking to be able to bridge/capture/etc. and specifically only
> receive the untagged frames that haven't already been pulled out into a vlan specific
> interface.
> 
> Is there any way to accomplish this without using ebtables or other similar hacks?

If you are dealing with a hw interface, any interface that supports vlan
filtering will by default receive only untagged frames.  Only when you put
into promiscuous mode, will you receive all frames.

With bridge, you could configure your vlans adjacent to you bridge:

   vlan0...N   bridge
     |          |
     +-- eth0 --+

This way, configured vlan traffic will go to vlan devices, while all other
traffic will got bridge.  You can even limit this "all other traffic"
further, by turning on vlan filtering on the bridge which will allow
you to run eth0 in non-promiscuous mode thus enforcing HW vlan filters.

-vlad

> 
> -- Nathan
> 
> ------------------------------------------------------------
> Nathan Neulinger                       nneul@neulinger.org
> Neulinger Consulting                   (573) 612-1412
> -- 
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Any way to configure a vlan interface to grab ONLY untagged frames?

[Nathan Neulinger]

That is a quite elegant solution. I will give that a try!

-- Nathan

On 09/14/2015 01:28 PM, Vlad Yasevich wrote:
> On 09/13/2015 12:49 PM, Nathan Neulinger wrote:
>> It seems like running 'vconfig add IFACE 0' and using IFACE.0 would do this, but it
>> doesn't actually seem to work that way.
>>
>> If I capture on IFACE directly, I'd expect to get all traffic, including the tagged frames
>> (with the tag intact). Looking to be able to bridge/capture/etc. and specifically only
>> receive the untagged frames that haven't already been pulled out into a vlan specific
>> interface.
>>
>> Is there any way to accomplish this without using ebtables or other similar hacks?
>
> If you are dealing with a hw interface, any interface that supports vlan
> filtering will by default receive only untagged frames.  Only when you put
> into promiscuous mode, will you receive all frames.
>
> With bridge, you could configure your vlans adjacent to you bridge:
>
>     vlan0...N   bridge
>       |          |
>       +-- eth0 --+
>
> This way, configured vlan traffic will go to vlan devices, while all other
> traffic will got bridge.  You can even limit this "all other traffic"
> further, by turning on vlan filtering on the bridge which will allow
> you to run eth0 in non-promiscuous mode thus enforcing HW vlan filters.
>
> -vlad
>
>>
>> -- Nathan
>>
>> ------------------------------------------------------------
>> Nathan Neulinger                       nneul@neulinger.org
>> Neulinger Consulting                   (573) 612-1412
>> --
>> To unsubscribe from this list: send the line "unsubscribe netdev" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

-- 
------------------------------------------------------------
Nathan Neulinger                       nneul@neulinger.org
Neulinger Consulting                   (573) 612-1412