netdev - Re: [PATCH net-next] net: dsa: Allow port mirroring to the CPU port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191003190907.GC21875@lunn.ch>
Date:   Thu, 3 Oct 2019 21:09:07 +0200
From:   Andrew Lunn <andrew@...n.ch>
To:     David Miller <davem@...emloft.net>
Cc:     olteanv@...il.com, f.fainelli@...il.com, vivien.didelot@...il.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next] net: dsa: Allow port mirroring to the CPU port

On Thu, Oct 03, 2019 at 12:04:57PM -0700, David Miller wrote:
> From: Vladimir Oltean <olteanv@...il.com>
> Date: Thu,  3 Oct 2019 02:37:50 +0300
> 
> > On a regular netdev, putting it in promiscuous mode means receiving all
> > traffic passing through it, whether or not it was destined to its MAC
> > address. Then monitoring applications such as tcpdump can see all
> > traffic transiting it.
> > 
> > On Ethernet switches, clearly all ports are in promiscuous mode by
> > definition, since they accept frames destined to any MAC address.
> > However tcpdump does not capture all frames transiting switch ports,
> > only the ones destined to, or originating from the CPU port.
> > 
> > To be able to monitor frames with tcpdump on the CPU port, extend the tc
> > matchall classifier and mirred action to support the DSA master port as
> > a possible mirror target.
> > 
> > Tested with:
> > tc qdisc add dev swp2 clsact
> > tc filter add dev swp2 ingress matchall skip_sw \
> > 	action mirred egress mirror dev eth2
> > tcpdump -i swp2
> > 
> > Signed-off-by: Vladimir Oltean <olteanv@...il.com>
> 
> Andrew and co., please review.

Yes, i thinking about this. Not reached a conclusion yet.

     Andrew