1

My home router has 2 internal interfaces on different subnets, and one external interface plugged into the comcast modem. I'd like to duplicate every packet that enters each interface out to a single virtual interface, at which I can direct Zeek. I think this should help me get full introspection of network traffic without duplicate logs like I'd get if I had Zeek monitor each interface separately.

While this works to duplicate traffic to "dummy0":

nft add table netdev filter
nft add chain netdev filter ingress { \
type filter hook ingress device eth0 priority 0\; }
nft add rule netdev filter ingress dup to dummy0

I cannot seem to extend it to also hook to additional ethernet devices. I find the nftables documentation to be extremely sparse on this sort of thing, so recommendations are appreciated.

0
1

With older nftables / kernel: one netdev basechain is registered to exactly one network device. If you need to duplicate the traffic of multiple interfaces, just create again a basechain with this same rule, registered to the other interface:

nft add table netdev filter
nft add chain netdev filter ingress0 '{ type filter hook ingress device eth0 priority 0; }'
nft add chain netdev filter ingress1 '{ type filter hook ingress device eth1 priority 0; }'
nft add rule netdev filter ingress0 dup to dummy0
nft add rule netdev filter ingress1 dup to dummy0

With nftables >= 0.9.3 and kernel >= 5.5: the same netdev basechain can register to multiple devices, avoiding the duplication:

nft add table netdev filter
nft add chain netdev filter ingress '{ type filter hook ingress devices = { eth0, eth1 } priority 0; }'
nft add rule netdev filter ingress dup to dummy0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.