I wrote a simple c program which can send and receive ether net frames using /dev/net/tun and I connected the tap interface with my ethernet nic using both the virtual bridge and veth pair.

I expected to see some traffic from my tap while capturing the ethernet card. the problem is see my packets coming from tap0 and i see them arriving at the bridge but i cant see arrive anything while capturing the ethernet card.

To be honest I have no idea what I am doing and so I tried configuring the bridge with netplan config files, brctl, ip and ifconfig.

I tried adding ip addresses of same subnet to br0 tap and enp8s0 and i tried to just give an ip adress to the bridge always with the same result, same thing while using veth

currently my setup is:

    #create tap0
    sudo ip tuntap add tap0 mode tap
    sudo ip link set tap0 promisc on

    #create Br0
    sudo ip link add br0  type bridge
    sudo ip link set enp8s0 promisc on

    #set to up
    sudo ip link set br0 up              #To add an interface br0s state must be up
    sudo ip link set enp8s0 up           #To add an interface its state must be up
    sudo ip link set dev tap0 up         #To add an interface its state must be up

    #Adding the interface into the bridge is done by setting its master to bridge_name: 
    sudo ip link set enp8s0 master br0
    sudo ip link set tap0 master br0
    sudo ip addr add dev br0

i am writing this structure to the tap filedescriptor:

struct eth_hdr
    unsigned char h_dest    [6];
    unsigned char h_source  [6];
    uint16_t ethertype;
    unsigned char payload[];
} __attribute__((packed)); 

wireshark shows a valid ethernet frame but i am not sure what source mac would be appropriate

what can i do to get my ethernet headers from tap0 to enp8s0


1 Answer 1


You can think of a bridge as a switch. That means you will only see packets at enp8s0 if they are meant for enp8s0.

To see traffic you then have at least three options (no specific order):

  • Send traffic directly to enp8s0's MAC address
  • Send traffic to the broadcast address FF:FF:FF:FF:FF:FF
  • Turn the switch into a hub (it will replicate the packets on all ports) with brctl setageing <bridge> 0. That's not how bridges usually work though.
  • thanks for quick reply i just tried all of your suggestions but i get the same result. nothing goes trough the bridge
    – KingKoopa
    Jan 4, 2021 at 14:23
  • Are you using the tap0 source MAC address reported by ip link list and destination address FF:FF:FF:FF:FF:FF? You can also try to create simple traffic (say, the ARP that would result from a ping and then copy all fields in your program. Wireshark will tell you if the packets are identical. If you choose an existing IP you will even have an answer on the wire. Jan 4, 2021 at 14:48
  • yes i used the mac address shown by ip link and the broadcast address. so you suggest to ping on the bridge ip address and simply copy the packet to send it via tap0? i this case i will have to switch source and destination mac before sending?
    – KingKoopa
    Jan 4, 2021 at 16:35
  • a ping to br0s ip adrdess is showing that something was send back but i cant see anything capturing br0 for some reason. dont know if its relevant but maybe it could tell whats going wrong
    – KingKoopa
    Jan 4, 2021 at 16:51
  • Ping a non existent address in the br0's network to see the ARP packets (see above). And then reconstruct that. Otherwise the packet will never see the link. Pinging br0's address from the same host would not go to the "wire", it is routed internally. And maybe check the traffic with something simpler, like sudo tcdump -ne -i br0. Jan 4, 2021 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.