Date: Sat, 11 Dec 2010 11:05:19 -0500 From: Michael Scheidell <michael.scheidell@secnap.com> To: <freebsd-security@freebsd.org> Subject: packet capture and if_bridge ignore bpf rules Message-ID: <4D03A13F.7070204@secnap.com>
next in thread | raw e-mail | index | archive | help
I am just not working on tracking this down, and sometimes like to use
tcpdump/tshark to watch specific packets on a host to look for
'interesting' things.
I think I have seen this since 6.x I don't remember it on 5.x, but 5.x
used 'bridge' and 6.x and 7.x are using if_bridge.
system is 7.3, amd64. tried this on 6.x amd64, and i386. same results.
googled a lot and didn't see anything I could use.
problem:
if I am on a network using if_bridge, the 'FILTER' section of bpf seems
to be ignored, or sorta backward. tried with tcpdump, tshark, snort, etc.
example: normal interface:
tshark -niem0 net 204.89.241.0/24
sees traffic to and from that net (tcpdump, same thing)
HOWEVER..
tshark -niem0 net 204.89.241.0/24 sees NOTHING
tshark -niem1 net 204.89.241.0/24 sees NOTHING
tshark -nibridge0 net 204.89.241.0/24 sees NOTHING
tshark (em0|em1|bridge0) sees 204.89.241.0/24 if I do this:
tshark (em0|em1|bridge0) not net 204.89.241.0/24
(actually looks like it sees everything and ignores the bpf filter.
using -F on tcpdump,
using -f 'net 204.89.241.0/24' on wireshark doesn't help.
em0 and em1 have no ip assigned and are brought up like this:
ifconfig_em0="-arp up"
ifconfig_em1="-arp up"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em1 stp em1 addm em0 stp em0 up"
ifconfig looks like this:
em1: flags=89c3<UP,BROADCAST,RUNNING,NOARP,PROMISC,SIMPLEX,MULTICAST>
metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:30:64:05:ef:56
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
em0: flags=89c3<UP,BROADCAST,RUNNING,NOARP,PROMISC,SIMPLEX,MULTICAST>
metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 00:30:64:05:ef:57
media: Ethernet autoselect (1000baseTX <full-duplex>)
status: active
bce0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=1bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4>
ether 00:1d:09:6b:75:e2
inet 192.168.100.40 netmask 0xffffff00 broadcast 192.168.100.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
inet 127.0.0.1 netmask 0xff000000
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu
1500
ether ea:62:40:63:41:3b
id 00:1d:09:6b:75:e2 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
root id 00:1d:09:6b:75:e2 priority 32768 ifcost 0 port 0
member: em0 flags=1c7<LEARNING,DISCOVER,STP,AUTOEDGE,PTP,AUTOPTP>
ifmaxaddr 0 port 3 priority 128 path cost 2000000 proto rstp
role designated state forwarding
member: em1 flags=1e7<LEARNING,DISCOVER,STP,EDGE,AUTOEDGE,PTP,AUTOPTP>
ifmaxaddr 0 port 2 priority 128 path cost 2000000 proto rstp
role designated state forwarding
so, what magic to make bpf filters work?
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best in Email Security,2010: Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4D03A13F.7070204>