I have been trying to configure port mirror on Virtual bridge created using open vswitch.

I have created the following ports on Bridge demo_bridge using:

sudo ovs-vsctl add-port demo_bridge victim0

Bridge demo_bridge
   Port "demo_bridge"
       Interface demo_bridge
           type: internal
   Port "victim0"
       Interface victim0
           type: internal
   Port "attacker0"
       Interface attacker0
           type: internal
   Port "wireshark0"
       Interface wireshark0
           type: internal
ovs_version: "2.5.2"

I am conducting a simple experiment where VM1 (attached to attacker0) is going to attack VM2 (attached to victim0), and I need to mirror all traffic from attacker0 vport to wireshark0 (VM3 capturing network traffic). However, whenever I enable mirroring, I can no longer ping from VM1 (Attacker VM) to VM3 (Wireshark VM); furthermore I cannot see any mirrored traffic on VM3 either.

These are the two set of commands I have used to create mirror port, and none of them work:

sudo ovs-vsctl  \
-- set Bridge demo_bridge mirrors=@m1  \
-- --id=@attacker0 get Port attacker0  \
-- --id=@wireshark0 get Port wireshark0  \
-- --id=@m1 create Mirror name=port_mirror1 select-dst-port=@attacker0 select-src-port=@attacker0 output-port=@wireshark0

//From YOUTUBE Video

sudo ovs-vsctl  \
-- --id=@p get port victim0  \
-- --id=@m create mirror name=mirror0  \
-- add bridge demo_bridge mirrors @m  \
-- set mirror mirror0 output_port=@p 

//Activate the mirror

sudo ovs-vsctl \
-- --id=@p get port ens3 \
-- set mirror mirror0 select_dst_port=@p \
-- set mirror mirror0 select_src_port=@p  

These commands do create the mirror port, but they also break the network connection between the attacker VM1 and victim VM2. When the mirror is removed, I can ping to all VM just fine. The local interface on each VM (ens3) has a static IP addresses connected to the Bridge demobridge. /etc/network/interfaces

auto ens3
iface ens3 inet static

Have you tried using tcpdump to listen on the interface of the vm?

I'm not sure what you are using as a hypervisor, but you should be able to run ip addr, and if you can see the ports of the vswitch; in that output you can capture on those ports in tcpdump.

You can also run tcpdump -D, and that will tell you what libpcap is aware of on the host machine for capturing.

For example if you are running KVM as the hypervisor you can get the mac address and name of the port the vm is associated with.

# Assuming your xml files for the vms are in the default location also. cat /etc/libvirt/qemu/{{ name_of_vm }}.xml | grep -A 2 interface

From this output you can match up the output from ip addr using the last two digits from the mac address as a filter.

ip a | grep -B 1 -i {{ last_two }}

The interface that is returned can then be used by tcpdump.

tcpdump -ni {{ vnet_name }} -s0 -vw /var/tmp/{{ vnet_port_out }}.pcap

This will capture everything on that port unfiltered.


I have mirror traffic succesfuly, see follow: enter image description here in my case mirror vm1 traffic in br-int to vm0, vm0 have two port one manager another receive traffic

vm0 receive port is 7df1c457-7732-44b2-bf15-63b0b661f1b7

vm1 port is 7eb61cc2-d059-4002-acef-b38e242ce4a5

  1. pull interface "tapxxxx" from linux bridge "qbrxxxxx"

    brctl delif qbr7df1c457-77 tap7df1c457-77
  2. add interface "tapxxxx" to br-int

    ovs-vsctl add-port br-int tap7df1c457-77
  3. mirror br-int traffic to port tap7df1c457-77

    ovs-vsctl -- --id=@tap1 get port qvo7eb61cc2-d0 -- --id=@tap2 get port tap7df1c457-77 -- --id=@m create mirror name=m0 select_dst_port=@tap1 select_src_port=@tap1 output_port=@tap2 -- set bridge br-int mirrors=@m

the qvo7eb61cc2-d0 is vm1's port.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.