How to make nftables duplicate multiple interfaces to one interface

Question

My home router has 2 internal interfaces on different subnets, and one external interface plugged into the comcast modem. I'd like to duplicate every packet that enters each interface out to a single virtual interface, at which I can direct Zeek. I think this should help me get full introspection of network traffic without duplicate logs like I'd get if I had Zeek monitor each interface separately.

While this works to duplicate traffic to "dummy0":

nft add table netdev filter
nft add chain netdev filter ingress { \
type filter hook ingress device eth0 priority 0\; }
nft add rule netdev filter ingress dup to dummy0

I cannot seem to extend it to also hook to additional ethernet devices. I find the nftables documentation to be extremely sparse on this sort of thing, so recommendations are appreciated.

Answer 1

With older nftables / kernel: one netdev basechain is registered to exactly one network device. If you need to duplicate the traffic of multiple interfaces, just create again a basechain with this same rule, registered to the other interface:

nft add table netdev filter
nft add chain netdev filter ingress0 '{ type filter hook ingress device eth0 priority 0; }'
nft add chain netdev filter ingress1 '{ type filter hook ingress device eth1 priority 0; }'
nft add rule netdev filter ingress0 dup to dummy0
nft add rule netdev filter ingress1 dup to dummy0

With nftables >= 0.9.3 and kernel >= 5.5: the same netdev basechain can register to multiple devices, avoiding the duplication:

nft add table netdev filter
nft add chain netdev filter ingress '{ type filter hook ingress devices = { eth0, eth1 } priority 0; }'
nft add rule netdev filter ingress dup to dummy0