netdev - Re: Port mirroring (RFC)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YbmzAkE+5v7Mv89D@lunn.ch>
Date:   Wed, 15 Dec 2021 10:18:58 +0100
From:   Andrew Lunn <andrew@...n.ch>
To:     Alex Elder <elder@...aro.org>
Cc:     Network Development <netdev@...r.kernel.org>,
        "bjorn.andersson@...aro.org" <bjorn.andersson@...aro.org>
Subject: Re: Port mirroring (RFC)

> IPA is a device that sits between the main CPU and a modem,
> carrying WWAN network data between them.
> 
> In addition, there is a small number of other entities that
> could be reachable through the IPA hardware, such as a WiFi
> device providing access to a WLAN.
> 
> Packets can travel "within IPA" between any of these
> "connected entities."  So far only the path between the
> AP and the modem is supported upstream, but I'm working
> on enabling more capability.
> 
> Technically, the replicated packets aren't visible on
> any one port; the only way to see that traffic is in
> using this special port.  To me this seemed like port
> mirroring, which is why I suggested that.  I'm want to
> use the proper model though, so I appreciate your
> response.

Do you have netdevs for the modem, the wifi, and whatever other
interfaces the hardware might have?

To setup a mirror you would do something like:

sudo tc filter add dev eth0 parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev tun0

where you are mirroring eth0 to tun0. eth0 would have to be your modem
netdev, or your wifi netdev, and tun0 would be your monitor device.

If you do have a netdev on the host for each of these network
interfaces, mirroring could work. Architecturally, it would make sense
to have these netdevs, so you can run wpa_supplicant on the wifi
interface to do authentication, etc.

Do you have control over selecting egress and ingress packets to be
mirrored?

	Andrew