4

I have to secure interfaces on Linux servers by setting bonding interfaces. The cabling information is not accurate.

Is there a simple way to know if two interfaces are connected to the same LAN?

Some interfaces have no IP, if possible I would prefer to not set dummies IPs.


I finally did it using arping, it was already installed on the servers:

ifconfig eth2 up 
ifconfig ethO up 
tcpdump -i eth2 -c 3 arp net 10.10.10.10

and in another terminal :

arping -D -I eth0 10.10.10.10

tcpdump should displays lines like that:

16:15:43.032103 arp who-has 10.10.10.10 (Broadcast) tell 0.0.0.0
16:15:44.032277 arp who-has 10.10.10.10 (Broadcast) tell 0.0.0.0
16:15:45.032441 arp who-has 10.10.10.10 (Broadcast) tell 0.0.0.0

*-D is optional but it gives a nice 0.0.0.0 source address.

  • 3
    Try to send an arp broadcast message on one interface and see if you can see it on the other one – Ulrich Dangel Jul 4 '14 at 12:46
  • @UlrichDagel I didn't managed to specifically generate ethernet datagrams on one interface. Do you know a standard command to do that ? – Emmanuel Jul 4 '14 at 13:49
  • you can either write your own tool or use somthing like scapy, arpscan etc and check in parallel with tcpdump on the other deice – Ulrich Dangel Jul 5 '14 at 1:36
6

Some ideas, assuming interfaces are eth0 and eth1:

  • Sniff on both interfaces at the same time for non unicast traffic. You should see all packets twice

    ( tcpdump -nni eth0 -c 10 broadcast or multicast & tcpdump -nni eth1 -c 10 broadcast or multicast & ) | sort
    
  • Probe with an IP-less protocol.

    For example with this tool to generate DHCP requests: http://www.latinsud.com/pub/dhd/dhd.c

    ( sleep 1; ./dhd eth1 > /dev/null ) & tcpdump -nni eth0 udp and port 68
    

    You should see something like this:

    14:46:16.449738 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:50:56:99:76:cb, length 300
    14:46:16.650330 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:50:56:99:76:cb, length 300
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.