1

Does anyone know if it's possible to mirror to multiple interfaces from one source interface using TC? I've done the following:

  1. The first thing I did was create an ingress queue on my input interface with tc qdisc add dev e101-001-0 handle ffff: ingress
    1. If you need to delete a qdisc you can do it with tc qdisc del dev e101-001-0 [ root | ingress ]
  2. Double check your queue with handle ffff was created with tc -s qdisc ls dev e101-001-0
  3. Next we want to mirror all traffic from the ingress port to an output port with tc filter add dev e101-001-0 parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev e101-005-0
  4. Check that your port mirror appeared in the config with tc -s -p filter ls dev e101-001-0 parent ffff:
    1. If you need to delete the filters you can do so with tc filter del dev e101-001-0 parent ffff:
  5. Set queue to not shape traffic with tc qdisc add dev e101-001-0 handle 1: root prio

That got it working outputting to one interface, but I noticed if I add another filter with a new interface the first interface stops receiving traffic and it all goes to the new interface.

3
  • Would several iptables TEE rules be an option instead of tc? – dirkt Oct 25 '19 at 7:01
  • Sure! That would work just as well. – Grant Curell Oct 25 '19 at 7:12
  • The only caveat is that there isn't a target IP to send to - it just needs to mirror it to a local interface. – Grant Curell Oct 25 '19 at 7:15
1

A tc action can have a control operator appended to alter further handling of packets:

CONTROL
The CONTROL indicates how tc should proceed after executing the action. Any of the following are valid:

reclassify
Restart the classifiction by jumping back to the first filter attached to the action's parent.

pipe
Continue with the next action. This is the default control.

drop
Drop the packed without running any further actions.

continue
Continue the classification with the next filter.

pass
Return to the calling qdisc for packet processing, and end classification of this packet.

It seems that after a matching filter no further filter is evaluated.

What you can simply do:

  • You can combine (pipe) multiple actions on the same filter (let's suppose the 2nd mirror interface is called e101-006-0):

    tc filter add dev e101-001-0 ingress u32 match u32 0 0 action mirred egress mirror dev e101-005-0 pipe action mirred egress mirror dev e101-006-0
    
  • You can also, instead, chain multiple filters (using action's continue control). Then an explicit prio/pref should be given because the order of filters will matter: the filter having the action with the continue control must be evaluated first.

    tc filter add dev e101-001-0 ingress pref 1 u32 match u32 0 0 action mirred egress mirror dev e101-005-0 continue
    tc filter add dev e101-001-0 ingress pref 2 u32 match u32 0 0 action mirred egress mirror dev e101-006-0
    

    This would be used over the 1st method if for example you'd want a different filter between the two actions (eg: one could match protocol ip the other protocol ipv6).

0

This is a bit of a workaround, but I realized I could just pump the traffic to a bridge instead and that effectively did the same thing. I'm open to better suggestions though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.