1

I have a switch in my home lab that I want to run some experiments with, especially with regards to VLANs and some other protocols that I want to better understand. Now, this switch (a TP-Link 5-port somewhat managed switch) allows for port mirroring.

This mirrored traffic I want to analyze on my computer with as little "new" traffic introduced from the monitoring machine as possible. How can I accomplish that?

I know already, that you have to put the NIC into promiscuous mode in order to receive packets not originally destined for my PC. As this is usually done by Wireshark itself, I don't have to worry about it.

However, I wanted to make sure to introduce as little "noise" on the port as possible, in order to really just look at the traffic generated on the other ports. I already found this answer that suggests disabling all services running (like DHCP et al), which makes sense. But while this will reduce the noise by a lot, it probably won't be able to prevent ARP resolution or other kernel-based network interactions.

I also learned that there are protocols meant specifically for this purpose (like Cisco's SPAN), but my switch doesn't have that ability.

So my question is: how can I use my network interface as read-only as it gets?

5
  • I don't think there should be ARPs or anything else going out on this interface. Don't give it an IP address, don't put it in your routing table, tell whatever network manager you use to leave it alone, and it will essentially be invisible to any applications running on the monitoring computer, except for those that specifically look for this interface - like tcpdump or Wireshark. The only condition it needs to fulfill for traffic tracing is to be up, not down, and promiscuous. Jun 15 at 12:09
  • 1
    What is your OS? This question would be OS dependent.
    – A.B
    Jun 15 at 22:28
  • @berndbausch Thanks for your comment, will try it. :)
    – mh166
    Jun 16 at 12:11
  • @A.B I have Arch and Debian at hand. But I might go with any other Linux distro, should there be a benefit in using another.
    – mh166
    Jun 16 at 12:12
  • Ok so this is Linux. It wasn't written.
    – A.B
    Jun 16 at 12:27
0

The easiest way to turn an interface "read-only" on Linux is to apply an egress tc filter on it that drops everything.

In order to apply a filter, a classful qdisc must be in place. The prio qdisc is the simplest classful qdisc, that is only used to be able to use filters on the interface, rather than for its own features.

In the end to set interface eth1 "read-only":

tc qdisc add dev eth1 root prio
tc filter add dev eth1 matchall action drop

This blocks outgoing traffic on this interface. It even block RAW sockets (which are otherwise unaffected by firewalls) so will block an IPv4 DHCP client (which can otherwise get an address despite a firewall). There are still ways to bypass it, but that can only be very deliberate. Here are two that I know of:

To return the interface in original state, just remove the qdisc:

tc qdisc del dev eth1 root

Notes:

  1. I would assume a switch with a port set in mirroring mode probably already set this port in read-only mode.

    That's something to test. And if true using the filter above or the bullet 2. below become moot.

  2. an interface that is UP and on which no additional setting is applied can still exchange traffic

    Without the previous filter, even having an unconfigured but UP interface can leave traffic. There are at least these two cases:

    • IPv6 auto configuration

      use sysctl -w net.ipv6.conf.eth1.disable_ipv6=1

    • If ARP is not disabled (with ip link set eth1 arp off)

      This case is the same case as the more general information leak case where a system in an LAN can probe to check if some systems are also using other networks (including virtual) with well known addresses: by default on Linux an interface will answer ARP requests for any other address on any other interface. That's part of the Weak Host Model.

      So for example if OP's system is running livbirt QEMU/KVM with default settings, 192.168.122.1/24 is assigned to virbr0, then an other Linux system only connected to an unconfigured UP interface will still get ARP answers through it when running:

      arping -I eth0 192.168.122.1
      

      It doesn't matter if the probing system has a route to 192.168.122.1. It's about ARP (and a command that doesn't care about routes). Same about LXC and 10.0.3.1 etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.