Re: Port mirroring (RFC)

[Andrew Lunn <andrew@lunn.ch>]

> IPA is a device that sits between the main CPU and a modem,
> carrying WWAN network data between them.
> 
> In addition, there is a small number of other entities that
> could be reachable through the IPA hardware, such as a WiFi
> device providing access to a WLAN.
> 
> Packets can travel "within IPA" between any of these
> "connected entities."  So far only the path between the
> AP and the modem is supported upstream, but I'm working
> on enabling more capability.
> 
> Technically, the replicated packets aren't visible on
> any one port; the only way to see that traffic is in
> using this special port.  To me this seemed like port
> mirroring, which is why I suggested that.  I'm want to
> use the proper model though, so I appreciate your
> response.

Do you have netdevs for the modem, the wifi, and whatever other
interfaces the hardware might have?

To setup a mirror you would do something like:

sudo tc filter add dev eth0 parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev tun0

where you are mirroring eth0 to tun0. eth0 would have to be your modem
netdev, or your wifi netdev, and tun0 would be your monitor device.

If you do have a netdev on the host for each of these network
interfaces, mirroring could work. Architecturally, it would make sense
to have these netdevs, so you can run wpa_supplicant on the wifi
interface to do authentication, etc.

Do you have control over selecting egress and ingress packets to be
mirrored?

	Andrew