Re: monitoring network question

[Grant Taylor <gtaylor@riverviewtech.net>]

On 11/12/08 07:57, Leonardo Rodrigues Magalhães wrote:
> i cannot use normal iptables -j ULOG rules, because there's no IP 
> traffic flowing on the box. Traffic flowing are ethernet frames on the 
> bridge.
> 
> i have tried ebtables with ulog as well:
> 
> ebtables -A FORWARD --ulog -j CONTINUE
> 
> and then fprobe-ulog to export packets, configuration with works just 
> fine with iptables ULOG, but didnt worked with ebtables ulog. Maybe i'm 
> missing some ebtables rule or different target than ulog ..... this is 
> the first time i've used ebtables anyway.

Have you considered enabling "Bridged NetFilter" (a.k.a. bridge-nf and 
brnf)?  That should allow IPTables to see the bridged ethernet frames. 
If IPTables can see the frames, you should be able to do what you are 
accustom to doing.  At least I think.

> but .... i got a third idea on how to accomplish that. My idea, with 
> this box, is to put it right in front the firewall (yes, with proper 
> authorization, nothing illegal here), so i would have the whole network 
> in one side of the bridge and the firewall on the other side of the 
> bridge. In other words ..... several MACs which i dont know which would 
> be on one side, and just a single MAC, known one, on the other side of 
> the bridge.
> 
> based on this, i tought on doing some arpspoof thing, having this box 
> to fake arp replies to the firewall MAC address and sending it's own and 
> then forwarding the frames to the real firewall.

Yuck.

IMHO this is in effect a poor mans form of Proxy ARP(ing), which is a 
very poor substitute for bridging.

> i dont know how to do this and dont know neither if this setup would 
> help me acchieving what i need.

I don't think it would.

Either you will be passing ethernet frames with out them passing through 
the higher IP stack, or you will be doing routing which will require 
modifying your network structure or some (IMHO very nasty) hacks with 
policy based routing.

> well .... i would like to hear some ideas on how to acchieve my 
> goals. Can anyone help me on this scenario ?

Take a look at bridged netfilter and see if it will do what you are 
wanting to do.



Grant. . . .