Linux Ethernet Bridging - May 2008 - [Bridge] How to determine where bridged packets originally come from ?

Hi all,

I ended up using raw packet sockets (ETH_P_ALL) with BPF filters attached
(binded on the bridge interface) to capture packets for the userspace
host.

Now having captured these packets from the bridge interface, how do I know
which interface (eth0, wifi0, ..) the packets were send from originally ?

Is there a handy solution to this without modifying the packet content ?

Please help me out I you got the answer down pat.

BR, Faruk

I was doing something similar with libpcap and hit the same problem.

My initial fix was to query the bridge forwarding table for each  
incoming packet on the basis that the src mac will have been learnt  
and the forwarding table updated.  To keep things vaguely efficient I  
cached the forwarding table and only queried it when the src mac  
wasn't found.

Later I opened multiple pcap sessions, one for each ethernet interface  
in the bridge and used a select statement to monitor them all.


Dylan



On 24/05/2008, at 8:04 PM, Faruk Keskin wrote:
> Hi all,
>
> I ended up using raw packet sockets (ETH_P_ALL) with BPF filters  
> attached
> (binded on the bridge interface) to capture packets for the userspace
> host.
>
> Now having captured these packets from the bridge interface, how do  
> I know
> which interface (eth0, wifi0, ..) the packets were send from  
> originally ?
>
> Is there a handy solution to this without modifying the packet  
> content ?
>
> Please help me out I you got the answer down pat.
>
> BR, Faruk
>
> _______________________________________________
> Bridge mailing list
> Bridge at lists.linux-foundation.org
> https://lists.linux-foundation.org/mailman/listinfo/bridge

> Hi all,
>
> I ended up using raw packet sockets (ETH_P_ALL) with BPF filters attached
> (binded on the bridge interface) to capture packets for the userspace
> host.
>
> Now having captured these packets from the bridge interface, how do I know
> which interface (eth0, wifi0, ..) the packets were send from originally ?
>
> Is there a handy solution to this without modifying the packet content ?
>
> Please help me out I you got the answer down pat.
>
> BR, Faruk
>
Hi all, there's been a patch which introduced a new option for packet
sockets returning the original device which was eventually bonded. It's
called ORIGDEV.

BR, Faruk