packet capture and if_bridge ignore bpf rules

Michael Scheidell michael.scheidell at secnap.com
Sat Dec 11 16:05:21 UTC 2010


I am just not working on tracking this down, and sometimes like to use 
tcpdump/tshark to watch specific packets on a host to look for 
'interesting' things.
I think I have seen this since 6.x  I don't remember it on 5.x, but 5.x 
used 'bridge' and 6.x and 7.x are using if_bridge.

system is 7.3, amd64.  tried this on 6.x amd64, and i386. same results.
googled a lot and didn't see anything I could use.

problem:

if I am on a network using if_bridge, the 'FILTER' section of bpf seems 
to be ignored, or sorta backward. tried with tcpdump, tshark, snort, etc.

example:  normal interface:

tshark -niem0 net 204.89.241.0/24

sees traffic to and from that net (tcpdump, same thing)

     HOWEVER..

tshark -niem0 net 204.89.241.0/24 sees NOTHING
tshark -niem1 net 204.89.241.0/24 sees NOTHING

tshark -nibridge0 net 204.89.241.0/24 sees NOTHING

tshark (em0|em1|bridge0) sees 204.89.241.0/24 if I do this:
tshark (em0|em1|bridge0) not net 204.89.241.0/24

(actually looks like it sees everything and ignores the bpf filter.

using -F on tcpdump,
using -f 'net 204.89.241.0/24' on wireshark doesn't help.

em0 and em1 have no ip assigned and are brought up like this:
ifconfig_em0="-arp up"
ifconfig_em1="-arp up"
cloned_interfaces="bridge0"
ifconfig_bridge0="addm em1 stp em1 addm em0 stp em0 up"

ifconfig looks like this:
em1: flags=89c3<UP,BROADCAST,RUNNING,NOARP,PROMISC,SIMPLEX,MULTICAST> 
metric 0 mtu 1500
     options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
     ether 00:30:64:05:ef:56
     media: Ethernet autoselect (1000baseTX <full-duplex>)
     status: active
em0: flags=89c3<UP,BROADCAST,RUNNING,NOARP,PROMISC,SIMPLEX,MULTICAST> 
metric 0 mtu 1500
     options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
     ether 00:30:64:05:ef:57
     media: Ethernet autoselect (1000baseTX <full-duplex>)
     status: active
bce0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
 
options=1bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4>
     ether 00:1d:09:6b:75:e2
     inet 192.168.100.40 netmask 0xffffff00 broadcast 192.168.100.255
     media: Ethernet autoselect (100baseTX <full-duplex>)
     status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
     inet 127.0.0.1 netmask 0xff000000
bridge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 
1500
     ether ea:62:40:63:41:3b
     id 00:1d:09:6b:75:e2 priority 32768 hellotime 2 fwddelay 15
     maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
     root id 00:1d:09:6b:75:e2 priority 32768 ifcost 0 port 0
     member: em0 flags=1c7<LEARNING,DISCOVER,STP,AUTOEDGE,PTP,AUTOPTP>
             ifmaxaddr 0 port 3 priority 128 path cost 2000000 proto rstp
             role designated state forwarding
     member: em1 flags=1e7<LEARNING,DISCOVER,STP,EDGE,AUTOEDGE,PTP,AUTOPTP>
             ifmaxaddr 0 port 2 priority 128 path cost 2000000 proto rstp
             role designated state forwarding

so, what magic to make bpf filters work?

-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best in Email Security,2010: Network Products Guide
    * King of Spam Filters, SC Magazine 2008

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________  


More information about the freebsd-security mailing list