0

I have two linux machines running debian 10, they both have dual interfaces. I have built a tunnel between the two machines and mirrored traffic from host1 collection interface to tunnel on host 2. I then mirror tunnel on host 2 to secondary interface on host 2.
Testing with tcpreplay. I first tested host 2 secondary interface by replaying traffic on it direct, I see all packets. I then tested host 2 tunnel interface by replaying traffic on the tun0 to see if TC mirror was working, and it did. I saw all packets on host 2 secondary interface. I then moved to host 1 and performed a tcpreplay on host 1 tun0 while watching host 2 secondary interface with tcpdump and I saw all traffic. Finally I moved to collection interface on host 1 and replayed traffic... but alas, only broadcast/multicast traffic is mirrored through the chain.

Host1 Collection Interface

 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0
qdisc pfifo_fast 0: parent :2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0
qdisc pfifo_fast 0: parent :1 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 0 bytes 0 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0
qdisc ingress ffff: parent ffff:fff1 ---------------- 
 Sent 6701767 bytes 29081 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0

Filter Host1 Collection

filter protocol all pref 49152 u32 chain 0 
filter protocol all pref 49152 u32 chain 0 fh 800: ht divisor 1 
filter protocol all pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid ??? not_in_hw  (rule hit 23735 success 23735)
  match 00000000/00000000 at 0 (success 23735 ) 
    action order 1: mirred (Egress Mirror to device tun0) pipe
    index 1 ref 1 bind 1 installed 5721 sec used 0 sec
    Action statistics:
    Sent 6163302 bytes 24570 pkt (dropped 0, overlimits 0 requeues 0) 
    backlog 0b 0p requeues 0

For completeness sake Host 2 Tun 0

qdisc pfifo_fast 0: root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
 Sent 168 bytes 4 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0
qdisc ingress ffff: parent ffff:fff1 ---------------- 
 Sent 8323387 bytes 71053 pkt (dropped 0, overlimits 0 requeues 0) 
 backlog 0b 0p requeues 0

Host 2 Tun0 Filter

filter protocol all pref 49152 u32 chain 0 
filter protocol all pref 49152 u32 chain 0 fh 800: ht divisor 1 
filter protocol all pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 terminal flowid ??? not_in_hw  (rule hit 70881 success 70881)
  match 00000000/00000000 at 0 (success 70881 ) 
    action order 1: mirred (Egress Mirror to device enp2s0) pipe
    index 1 ref 1 bind 1 installed 7264 sec used 0 sec
    Action statistics:
    Sent 8306691 bytes 70881 pkt (dropped 0, overlimits 0 requeues 0) 
    backlog 0b 0p requeues 0

I am hoping that is something silly that I am overlooking..... Any help would be appreciated. I don't know why it's not mirroring the unicast inside the tcpreplay at Host1 collection.

1
  • I don't follow completely your explanations, but if host's 2 interface is to be a mirror of host's 1 interface, then you must use the same MAC address or set it in promiscuous mode: before TC, there's the hardware filter. – A.B Mar 30 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.