Ytdyklly

I have a Linksys E2500 router running Tomato v1.28 (Linux kernel 2.6.22.19, no USB drive capability) that is functioning in bridge mode to connect three interfaces:

root@TomatoE2500Host:/# brctl show

bridge name     bridge id               STP enabled     interfaces

br0             8000.586d8fb74454       no              eth1

                                                        eth2

                                                        vlan1

• eth1 is the 2.4 Ghz wireless (access point mode - Xbox is only wireless host)


• eth2 is the 5.0 Ghz wireless (client mode to main gateway router / other devices)


• vlan1 is the 4x LAN ethernet ports (Windows 10 desktop is only wired host)

The bridge works fine for 'normal' purposes, but I am trying to use the Windows desktop running Wireshark to sniff packets being sent between the Xbox and the main gateway.

root@TomatoE2500Host:/# brctl showmacs br0

port no mac addr                is local?       ageing timer

  3     00:01:36:1f:e4:5c       yes                0.00

  2     4c:0b:be:3e:5b:2d       no                36.09

  1     58:6d:8f:b7:44:54       yes                0.00

  2     58:6d:8f:b7:44:56       yes                0.00

  3     68:37:e9:50:ce:f7       no               100.34

  3     6c:56:97:04:1e:3f       no               100.63

  3     a0:cc:2b:ad:46:d1       no               224.45

  3     b0:39:56:69:aa:eb       no                 1.02

  1     f4:6d:04:4f:9f:6a       no                 0.01

Understandably, frames/packets from the Xbox (4c:0b:be:3e:5b:2d) on eth1 (port 2) are only getting pushed to the gateway (b0:39:56:69:aa:eb) on eth2 (port 3) while the wired desktop (f4:6d:04:4f:9f:6a) on vlan1 (port 1) is getting left in the dark.

How do I force frames from the eth1 interface to be broadcast on vlan1 interface, in addition to the default/needed eth2?

It is as if I need a MAC Flooding attack on myself to force the bridge into broadcasting packets on multiple interfaces, instead of relying on its forwarding database (FDB) shown above. But there has to be a better way to enable this, right?

The forwarding database only supports mapping unicast addresses to one port (which is apropriate for 'unicast' having one destination). There are other methods:

• 
  

  You can use iptables' TEE target, as in this SF thread. For this to work you'll need to enable bridge iptables filtering first:

  
  
  

  ip link set dev br0 type bridge nf_call_iptables 1
  
  

  
  


• 
  

  Similarly, you can probably use the dup action in nftables bridge table:

  
  
  

  iifname "br0" dup to "eth0"
  
  

  
  



• As in this article, you can use tc with "action mirred" and some other incomprehensible parameters.




• You can use a userspace program to capture packets on the bridge and forward them through another interface, either raw or encapsulated (e.g. inside a TZSP or ERSPAN tunnel). One example is RSniffer. On the receiving side, Wireshark will automatically recognize the encapsulated packets.



• 
  

  You can run tcpdump via SSH and feed its output to a local Wireshark UI:

  
  
  

  ssh router tcpdump -n -i eth2 -s 65535 -w - -U | wireshark -k -i -
  
  

  
  
  

  (Yes web says you need a USB drive for the "full" 2 MB tcpdump, but surely there's a lite version somewhere (something like dumpcap)? You don't need any of the packet analysis code, for example. It seems like this sort of thing shouldn't need a binary larger than 10 kB...)

  
  



• As a last resort, you can buy another switch or router which has native port-mirroring support. (For example, managed switches tend to have a "mirror port" or a "SPAN port", and RouterOS-based devices have native support for tcpdump-like capture through a TZSP tunnel.)

Note, though, that your Linksys very likely has two bridges stacked – the "vlan1" device (your 4x LAN ports) often represents a hardware switch which has its own independent FDB, so traffic between these ports doesn't reach the software Linux bridge at all.