Port mirror over vlan possible?

Installing and Using OpenWrt
1

Hello!,

So currently I was reading some use cases about port mirroring and IDS systems and then wondered if this was also possible to mirror over a vlan so I can have a easily encapisulated way of getting read only access towards a orange pi, I learned that I need to use the tc command for this.

Currently I have a Flint 2 but when I tried the suggested commands by Google AI it seems I need to enable some kernel modules, but I was not able to find them :grinning_face:

What I'm looking for all modules like:

CONFIG_NET_CLS_* for mirred and filter and a few other names I used * for this.

Is this supported in the OpenWrt kernel by enabling in the diffconfig?, when I search CLS in make menuconfig I can't find anything to these kernel values :+1:, are they in some package?

Edit this was the code I was looking to not sure if it makes sense by the Ai I need to rewrite it for eth1:

# 1. Add the ingress filter to mirror incoming traffic
tc qdisc add dev eth0 handle ffff: ingress
tc filter add dev eth0 parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev br-lan.10

# 2. Add the egress filter to mirror outgoing traffic
tc qdisc add dev eth0 root handle 1: htb
tc filter add dev eth0 parent 1: protocol all u32 match u32 0 0 action mirred egress mirror dev br-lan.10

But it says illegal action on mirred further searches told me I need modules enabled (compile them in my OpenWrt build).

2

I found a solution to this problem :smiley::+1:

First I need to ensure both kmod-ifb and kmod-sched-core is present, kmod-sched-core is needed for those missing CLS modules, but for the mirred part I need tc-full.

This is what I did to succeed:

First create the ifb device this type is asked in the ai generated command and not just a DSA device for mirred!

ip link add dev mirror0 type ifb

start the device:

ip link set dev mirror0 up

Because I have vpn traffic I think it was better to mirror br-lan entirely, but I think you must have hardware offloading off entirely it is a heavy process I think and there surely is a hardware limitation so I won't encourage this, I had a single instance of running out conntrack already but for a single port it is safer.

So this is what I did:

# 1. Add the ingress filter to mirror incoming traffic
tc qdisc add dev br-lan handle ffff: ingress
tc filter add dev br-lan parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev br-lan.222

# 2. Add the egress filter to mirror outgoing traffic
tc qdisc add dev br-lan root handle 1: htb
tc filter add dev br-lan parent 1: protocol all u32 match u32 0 0 action mirred egress mirror br-lan.222

And then there is no error because ifb was expected, though I skipped #2 line because i want only egress anyway.

I did a test with tcpdump and I see traffic in mirror0, but now the question remains what happens if I put mirror0 in br-lan and tag it on vlan 222 I think this is a bad idea :smiling_face_with_tear:, but haven't tested :+1:, to me it is already a acomplishment :grinning_face:

But I think the full bridge maybe is too much to mirror.

Edit:

What I have said about ifb this is incorrect, in order so that the device is found by the tc commands, is that the br-lan.222 must be hold under a active interface with protocol as unmanaged this will trigger the ip link up for the device :slight_smile:

I also edited the snipped to properly reflect my usage to mirror br-lan bridge to br-lan.222 and then inside the bridge vlan filtering I can tag my port, you only want to use command #2 if you also want inbound, but since firewalls work as src to dest, I don't think I need inbound... I want to see only outbound traffic in my IDS.