Sniff network with the Pi

Sessa45 · January 17, 2019, 2:26pm

Unfortunately, I get the same error.

frank-w · January 17, 2019, 2:30pm

i guess kernel 4.4 is missing anything in official image or libnl is too old

gunzip < /proc/config.gz | grep BRIDGE

this is how it looks like on 4.20:

root@bpi-r2:~# modprobe configs                                                                                                     
root@bpi-r2:~# zgrep BRIDGE /proc/config.gz                                                                                         
# CONFIG_ARCH_FOOTBRIDGE is not set                                                                                                 
CONFIG_BRIDGE_NETFILTER=m                                                                                                           
CONFIG_NETFILTER_FAMILY_BRIDGE=y                                                                                                    
# CONFIG_BRIDGE_NF_EBTABLES is not set                                                                                              
CONFIG_BRIDGE=m                                                                                                                     
CONFIG_BRIDGE_IGMP_SNOOPING=y                                                                                                       
CONFIG_BRIDGE_VLAN_FILTERING=y                                                                                                      
CONFIG_DRM_BRIDGE=y                                                                                                                 
CONFIG_DRM_PANEL_BRIDGE=y

you can also try to find bridge-module this way…

root@bpi-r2:~# find /lib/modules/$(uname -r) -name '*bridge*.ko'                                                                    
/lib/modules/4.20.0-rc7-bpi-r2-fbdev/kernel/net/bridge/bridge.ko

if it is there try to load it (modprobe bridge) or try a depmod -a

you could try my image but have to bridge lanx/wan-ports instead of eth0/1 because of kernel 4.14

Sessa45 · January 17, 2019, 2:54pm

Ah okay. I found nothing like you have posted on my system.

frank-w · January 17, 2019, 3:13pm

afair bpi-team missed some modules in their official images…

github.com

BPI-SINOVOIP/BPI-R2-bsp/blob/master/linux-mt/arch/arm/configs/mt7623n_evb_bpi_defconfig#L1113


CONFIG_ATM_BR2684=m
CONFIG_ATM_BR2684_IPFILTER=y
CONFIG_L2TP=m
# CONFIG_L2TP_DEBUGFS is not set
CONFIG_L2TP_V3=y
CONFIG_L2TP_IP=m
CONFIG_L2TP_ETH=m
CONFIG_STP=m
CONFIG_GARP=m
CONFIG_MRP=m
CONFIG_BRIDGE=m
CONFIG_BRIDGE_IGMP_SNOOPING=y
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_HAVE_NET_DSA=y
# CONFIG_NET_DSA is not set
CONFIG_VLAN_8021Q=m
CONFIG_VLAN_8021Q_GVRP=y
CONFIG_VLAN_8021Q_MVRP=y
CONFIG_DECNET=m
CONFIG_DECNET_ROUTER=y
CONFIG_LLC=m

shows module should be included…you can rebuild kernel and copy modules to its place…

i have only newer versions of my fork here compiled…

fastest way should be using one my images

Sessa45 · January 18, 2019, 12:09pm

Where can i find your images? I need a simple debian to sniff the traffic.

frank-w · January 18, 2019, 2:42pm

https://www.fw-web.de/dokuwiki/doku.php?id=en:bpi-r2:start

my own (Debian/Ubuntu): GoogleDrive

Sessa45 · January 19, 2019, 6:44pm

Thanks to the great help from frank-w everything was configured so far. I have now created a bridge between the LAN port 1 & port 2, so that the clients in the LAN are routed through the bridge and vice versa. Now the tcpdump is missing. LAN1 goes to the firewall. LAN2 to the client network. if I put a tcpdump on LAN1, I get the info of the PI’s. However I need the information of the network of LAN2. Someone an idea?

Sessa45 · January 20, 2019, 4:29pm

@moore maybe you have an idea here :)?

moore · January 21, 2019, 1:37pm

Do you mean you want to monitor port 1 and 2? if yes, you can use “tcpdump -i br0 -xxx”, thanks.

Sessa45 · January 21, 2019, 1:44pm

Yes. I need to monitor the traffic which goes through the bridge. Unfortunately, your command works not.

Any other idea?

frank-w · January 21, 2019, 2:01pm

Dsa-ports seem not supporting promiscuous mode…only traffic targeting r2 can be captured…all other (going through br0) are not shown

Sessa45 · January 23, 2019, 10:13am

Unfortunately, it still does not work work.

It can not be that hard to create a dump. I just tested it with a server. Works (as expected) wonderful.

frank-w · January 23, 2019, 11:49am

I guess its only a “setting” missing in dsa-driver

maybe it’s only a flag that needs to br handled…

github.com

torvalds/linux/blob/master/net/bridge/br_if.c#L147


* under RTNL so can skip using rcu primitives.
*/
void br_manage_promisc(struct net_bridge *br)
{
	struct net_bridge_port *p;
	bool set_all = false;


	/* If vlan filtering is disabled or bridge interface is placed
	 * into promiscuous mode, place all ports in promiscuous mode.
	 */
	if ((br->dev->flags & IFF_PROMISC) || !br_vlan_enabled(br->dev))
		set_all = true;


	list_for_each_entry(p, &br->port_list, list) {
		if (set_all) {
			br_port_set_promisc(p);
		} else {
			/* If the number of auto-ports is <= 1, then all other
			 * ports will have their output configuration
			 * statically specified through fdbs.  Since ingress
			 * on the auto-port becomes forwarding/egress to other

Sessa45 · January 23, 2019, 12:47pm

Okay. So what have i to do now? ^^

frank-w · January 23, 2019, 2:14pm

@Ryder.Lee @moore can you help here getting promiscuous mode working on dsa-ports?

i see some messages in my bootlogs

[   12.431431] device lan1 entered promiscuous mode                                                                                   
[   12.431439] device eth0 entered promiscuous mode                                                                                   
[   12.689326] device lan2 entered promiscuous mode

but i guess it is not really set in switch (mt7530)

moore · January 23, 2019, 11:56pm

Did you tey to use below command to enable promiscuous mode?

#ifconfig br0 promisc #ip link set br0 promisc on

Sessa45 · January 24, 2019, 12:33pm

Hi,

i have tried your suggestion but it seems like it does not help …

frank-w · January 24, 2019, 1:57pm

imho tcpdump always try to set the device which listens on automaticly to promiscuous mode (except if -p is set). i guess mode is set in software, but not set in hardware, because it is not handled in driver (mt7530.c)

is it right to set promiscuous mode to br0 and not to the incoming dsa-port? i only used this for catching hw-ports but not in combination with sw-bridges.

Sessa45 · January 25, 2019, 12:27pm

Someone an idea? I need this as soon as possible …

linkerosa · February 24, 2019, 7:32am

https://lore.kernel.org/patchwork/patch/983190/

I guess that it causes the issue

So change to the latest user-land tools