netdev - Re: Any way to configure a vlan interface to grab ONLY untagged frames?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <55F71370.3000706@neulinger.org>
Date:	Mon, 14 Sep 2015 13:35:28 -0500
From:	Nathan Neulinger <nneul@...linger.org>
To:	Vlad Yasevich <vyasevich@...il.com>, netdev@...r.kernel.org
Subject: Re: Any way to configure a vlan interface to grab ONLY untagged
 frames?

That is a quite elegant solution. I will give that a try!

-- Nathan

On 09/14/2015 01:28 PM, Vlad Yasevich wrote:
> On 09/13/2015 12:49 PM, Nathan Neulinger wrote:
>> It seems like running 'vconfig add IFACE 0' and using IFACE.0 would do this, but it
>> doesn't actually seem to work that way.
>>
>> If I capture on IFACE directly, I'd expect to get all traffic, including the tagged frames
>> (with the tag intact). Looking to be able to bridge/capture/etc. and specifically only
>> receive the untagged frames that haven't already been pulled out into a vlan specific
>> interface.
>>
>> Is there any way to accomplish this without using ebtables or other similar hacks?
>
> If you are dealing with a hw interface, any interface that supports vlan
> filtering will by default receive only untagged frames.  Only when you put
> into promiscuous mode, will you receive all frames.
>
> With bridge, you could configure your vlans adjacent to you bridge:
>
>     vlan0...N   bridge
>       |          |
>       +-- eth0 --+
>
> This way, configured vlan traffic will go to vlan devices, while all other
> traffic will got bridge.  You can even limit this "all other traffic"
> further, by turning on vlan filtering on the bridge which will allow
> you to run eth0 in non-promiscuous mode thus enforcing HW vlan filters.
>
> -vlad
>
>>
>> -- Nathan
>>
>> ------------------------------------------------------------
>> Nathan Neulinger                       nneul@...linger.org
>> Neulinger Consulting                   (573) 612-1412
>> --
>> To unsubscribe from this list: send the line "unsubscribe netdev" in
>> the body of a message to majordomo@...r.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

-- 
------------------------------------------------------------
Nathan Neulinger                       nneul@...linger.org
Neulinger Consulting                   (573) 612-1412
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html