The goal

I have a Linux SBC (single board card) that has dual ethernet + wifi. I want to create a bridge using the two ethernet interfaces as slave interfaces. The aim is to use the device to sniff the traffic between two machines. There is also a wifi access point on wlan running hostapd.

The problem

The bridge does not seem to be fully isolated from traffic originating from other interfaces.

I would like to use NetworkManager because I like the convenience of being able to switch from one connection profile to another. From time to time I want to bring the bridge down and raise eth0/1 in DHCP to perform system updates. The wifi access point would continue to run unaffected.

My interfaces and MAC addresses are as follows:

eth0            70:cf:49:92:30:c5
eth1            70:cf:49:92:30:c6
wlan0           70:cf:49:92:30:c7

(The MAC addresses are spoofed)

Output of /etc/network/interfaces:

source /etc/network/interfaces.d/*

auto lo

iface lo inet loopback

I created the bridge as follows with nmcli:

nmcli connection add type bridge ifname br0 con-name br0 ipv4.method disabled ipv6.method ignore bridge.stp no

nmcli connection modify br0 connection.autoconnect-slaves 1

# add slaves: eth0, eth1
nmcli con add type ethernet slave-type bridge con-name br-slave-eth0 ifname eth0 master br0 autoconnect no
nmcli con add type ethernet slave-type bridge con-name br-slave-eth1 ifname eth1 master br0 autoconnect no

Based on this blog post: Proper isolation of a Linux bridge I created a pre-up hook as follows:

File name: /etc/NetworkManager/dispatcher.d/pre-up.d/01-vlan-filtering



if [ "$iface" = "br0" ] && [ "$action" = "pre-up" ] ; then
        bridge vlan del dev br0 vid 1 self
        echo 1 > /sys/class/net/br0/bridge/vlan_filtering

Although I doubt this actually has any meaningful effect.

Output of bridge vlan show:

port    vlan ids

eth0     1 PVID Egress Untagged

eth1     1 PVID Egress Untagged


I have also defined additional profiles (disabled by default) for eth0 and eth1 (regular DHCP). They are shown at the bottom.

Output of nmcli con show:

NAME           UUID                                  TYPE      DEVICE 

br0            677631d9-c9fa-4ec2-a666-e2c764300d8b  bridge    br0    
br-slave-eth0  8f6c705b-a71e-4f2e-9092-ccf055edaf41  ethernet  eth0   
br-slave-eth1  2bb50af6-d047-4f16-896b-de7e11e0c98a  ethernet  eth1   
eth0           92dbf4c5-65ce-42ad-9dec-200d1bac6931  ethernet  --     
eth1           fcec5a74-16d5-419e-8fb2-9ff8c4455f32  ethernet  --     

The first 3 lines: br0, br-slave-eth0, br-slave-eth1 are in green, indicating that the interfaces are connected and active.

The bridge works and is forwarding traffic as expected. However, it is evident that is not fully isolated. In order to verify isolation I connected both eth0 and eth1 to a Cisco managed switch (ports 6 and 7) and I have enabled port mirroring (SPAN) to port 8 on the Cisco switch to copy all packets to a dedicated network interface on my desktop PC, that is running Wireshark so I can see the packets passing through the bridge.

From time to time I see IGMPv3 packets as shown in attached screenshot. Some seem to come from wlan0. I can reproduce this traffic using Scapy on the SBC. PoC code:

from scapy.all import Ether, IP, sendp
from scapy.contrib.igmpv3 import IGMPv3, IGMP, IGMPv3gr, IGMPv3mr

packet = Ether(dst='01:00:5e:00:00:16', src='70:cf:49:92:30:c5') / IP(src='', dst='', tos=0xc0) /IGMPv3() /IGMPv3mr(numgrp=1) /IGMPv3gr(rtype=4, maddr="")
sendp(packet, iface='eth1')


I have a sniffer running on top of the bridge that performs live packet analysis and the traffic flowing through the bridge must not be tainted with traffic from other interfaces.

How can I achieve full isolation of the bridge ? I understand that I could use ebtables to selectively drop packets but am I missing something obvious perhaps ?

Software versions

  • OS: Armbian Buster: Linux nanopir1 5.10.4-sunxi #20.11.7 SMP Tue Jan 5 23:17:54 CET 2021 armv7l GNU/Linux
  • network-manager: 1.14.6-2+deb10u1


  • I have the br_netfilter module loaded (and 8021q as well)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.