Linux bridge/switch port mirroring/SPAN/port monitoring/Roving Analysis?

Linux bridge/switch port mirroring/SPAN/port monitoring/Roving Analysis?

[Erik Andersen]

Is there a way to port mirroring/SPAN on a linux bridge? If so, what
would I need to do to set it up? I'm hoping to port morror to
vboxnet0.
My current setup:
-------------------------------
br0 (used for LAN)
  eth5
  eth7
  eth10
  wlan1
  vboxnet0(when I'm running a Virtual Machine with virtualbox)

eth0-->DSL modem (bridging mode)
  ppp0(over eth0)-->ISP

--------------------------------

Thanks,
Erik B. Andersen

Re: Linux bridge/switch port mirroring/SPAN/port monitoring/Roving Analysis?

[Marek Kierdelewicz]

Hi,

>Is there a way to port mirroring/SPAN on a linux bridge? If so, what
>would I need to do to set it up? I'm hoping to port morror to
>vboxnet0.

Mirroring functionality is build into ifb[1]. There's tc action "mirred
egress mirror" which, used in a proper context, can mirror ingress
and/or egress traffic to other interface. In your case, mirrored
interface would be br0.

Here [2] our colegue is describing ingress mirroring from eth1 to
eth2-5.

And important note here [3] about using "protocol all" in tc filter, if
you also want to get non-ip traffic mirrored.

[1]
http://www.linuxfoundation.org/collaborate/workgroups/networking/ifb#IFB_Example
[2] http://marc.info/?l=linux-netdev&m=128853067804910&w=2
[3] http://marc.info/?l=linux-netdev&m=128861016403775&w=2

Best regards,
Marek Kierdelewicz

Re: Linux bridge/switch port mirroring/SPAN/port monitoring/Roving Analysis?

[Matty Sarro]

I know port mirroring is supported, however I've never implemented it.
SPAN isn't supported; its cisco proprietary.

On Mon, Feb 7, 2011 at 2:50 AM, Marek Kierdelewicz <marek@piasta.pl> wrote:
> Hi,
>
>>Is there a way to port mirroring/SPAN on a linux bridge? If so, what
>>would I need to do to set it up? I'm hoping to port morror to
>>vboxnet0.
>
> Mirroring functionality is build into ifb[1]. There's tc action "mirred
> egress mirror" which, used in a proper context, can mirror ingress
> and/or egress traffic to other interface. In your case, mirrored
> interface would be br0.
>
> Here [2] our colegue is describing ingress mirroring from eth1 to
> eth2-5.
>
> And important note here [3] about using "protocol all" in tc filter, if
> you also want to get non-ip traffic mirrored.
>
> [1]
> http://www.linuxfoundation.org/collaborate/workgroups/networking/ifb#IFB_Example
> [2] http://marc.info/?l=linux-netdev&m=128853067804910&w=2
> [3] http://marc.info/?l=linux-netdev&m=128861016403775&w=2
>
> Best regards,
> Marek Kierdelewicz
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>