Bug 1436535

*** Bug 909236 has been marked as a duplicate of this bug. ***

I was trying to set up some basic env. Taken from http://backreference.org/2014/06/17/port-mirroring-with-linux-bridges/ I tried this:

To do this, we need to attach a classifier (filter in tc speak) to the relevant qdisc. Simply put, a filter tries to match packets according to some criteria and, if the match succeeds, performs certain actions on them.

Let's start with the code to mirror incoming traffic for an interface, which is simpler. The first thing to do is to establish an ingress qdisc for the interface, as there's none by default:

# tc qdisc add dev bond0 ingress

This creates an ingress qdisc for bond0 and gives it the ffff: identifier (it's always ffff:, for any interface, so no surprises):

# tc qdisc show dev bond0
qdisc ingress ffff: parent ffff:fff1 ----------------

Now, as said, we attach a filter to it. This filter simply matches all packets, and mirrors them to dummy0. A filter is attached to a qdisc, so it must have a reference to the parent. Here's the syntax to create the filter:

# tc filter add dev bond0 parent ffff: \
    protocol all \
    u32 match u8 0 0 \
    action mirred egress mirror dev dummy0


I was able to catch basic dhcp response while upping bond0.0 and listening on dummy0. But I am unable to set this up via NM.

https://github.com/NetworkManager/NetworkManager/pull/338

(In reply to Lubomir Rintel from comment #13)
> https://github.com/NetworkManager/NetworkManager/pull/338

Could you please provide some info, how to set up mirroring as mentioned in c#11 in NetworkManager?

If I try to set the tc.tfilters via nmcli, any help I get is this:

   The valid syntax is: '[root | parent <handle>] [handle <handle>] <kind>'

How to fit 'protocol all u32 match u8 0 0 action mirred egress mirror dev dummy0' into that syntax? I can not read that from pull request above.

Thanks for help.

cannot make it in 7.7, moving to 7.8

to provide more details:
it still doesn't work as expected, we need to give it more care. 7.8.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/merge_requests/277

Upstream merge request:

 https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/545

Port mirroring in NM can be configured in the following way:

 nmcli connection add type ethernet ifname eth3 con-name mirror autoconnect no
 nmcli connection modify mirror +tc.qdisc "root prio handle 10:"
 nmcli connection modify mirror +tc.qdisc "ingress handle ffff:"
 nmcli connection modify mirror +tc.tfilter "parent ffff: matchall action mirred egress mirror dev dummy1"
 nmcli connection modify mirror +tc.tfilter "parent 10:   matchall action mirred egress mirror dev dummy1"
 nmcli connection up mirror

This will mirror all traffic (ingress and egress) on eth3 to dummy1.

Alternative version using the 'clsact' qdisc:

    nmcli connection modify mirror +tc.qdisc "clsact"
    nmcli connection modify mirror +tc.tfilter "parent ffff:fff3 matchall action mirred egress mirror dev dummy1"
    nmcli connection modify mirror +tc.tfilter "parent ffff:fff2  matchall action mirred egress mirror dev dummy1"

(supported since https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/e6acf64859fc1b4cc125608604cf38ae77c85367 )

two CI tests added:
https://gitlab.freedesktop.org/NetworkManager/NetworkManager-ci/-/merge_requests/642

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: NetworkManager and libnma security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:1574