I have been trying to configure port mirror on Virtual bridge created using open vswitch.
I have created the following ports on Bridge demo_bridge using:
sudo ovs-vsctl add-port demo_bridge victim0 Bridge demo_bridge Port "demo_bridge" Interface demo_bridge type: internal Port "victim0" Interface victim0 type: internal Port "attacker0" Interface attacker0 type: internal Port "wireshark0" Interface wireshark0 type: internal ovs_version: "2.5.2"
I am conducting a simple experiment where VM1 (attached to attacker0) is going to attack VM2 (attached to victim0), and I need to mirror all traffic from attacker0 vport to wireshark0 (VM3 capturing network traffic). However, whenever I enable mirroring, I can no longer ping from VM1 (Attacker VM) to VM3 (Wireshark VM); furthermore I cannot see any mirrored traffic on VM3 either.
These are the two set of commands I have used to create mirror port, and none of them work:
sudo ovs-vsctl \ -- set Bridge demo_bridge mirrors=@m1 \ -- --id=@attacker0 get Port attacker0 \ -- --id=@wireshark0 get Port wireshark0 \ -- --id=@m1 create Mirror name=port_mirror1 select-dst-port=@attacker0 select-src-port=@attacker0 output-port=@wireshark0
//From YOUTUBE Video
sudo ovs-vsctl \ -- --id=@p get port victim0 \ -- --id=@m create mirror name=mirror0 \ -- add bridge demo_bridge mirrors @m \ -- set mirror mirror0 output_port=@p
//Activate the mirror
sudo ovs-vsctl \ -- --id=@p get port ens3 \ -- set mirror mirror0 select_dst_port=@p \ -- set mirror mirror0 select_src_port=@p
These commands do create the mirror port, but they also break the network connection between the attacker VM1 and victim VM2. When the mirror is removed, I can ping to all VM just fine. The local interface on each VM (ens3) has a static IP addresses connected to the Bridge demobridge. /etc/network/interfaces
auto ens3 iface ens3 inet static address 126.96.36.199 network 188.8.131.52/27 netmask 255.255.255.0