port-mirroring
port-mirroring copied to clipboard
If it works on pppoe?
I try to mirror the traffic on a pppoe network but receive nothing and --debug shows no error
details:
15:49:03 root@OpenWrt ~ ifconfig
br-lan Link encap:Ethernet HWaddr AA:AA:AA:11:11:11
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fdf9:5c46:674e::1/60 Scope:Global
inet6 addr: 2001:470:1f19:1b5::1/64 Scope:Global
inet6 addr: fe80::e695:6eff:fe40:2133/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:62878 errors:0 dropped:0 overruns:0 frame:0
TX packets:63097 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:6352932 (6.0 MiB) TX bytes:19405120 (18.5 MiB)
eth0 Link encap:Ethernet HWaddr E4:95:6E:40:21:33
inet addr:100.64.215.143 Bcast:100.64.255.255 Mask:255.255.0.0
inet6 addr: fe80::e695:6eff:fe40:2133/64 Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:1219431 errors:0 dropped:995 overruns:0 frame:0
TX packets:954829 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1308812165 (1.2 GiB) TX bytes:99050584 (94.4 MiB)
Interrupt:4
eth1 Link encap:Ethernet HWaddr E4:95:6E:40:21:33
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1214169 errors:0 dropped:0 overruns:0 frame:0
TX packets:1093214 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:460244586 (438.9 MiB) TX bytes:1203312990 (1.1 GiB)
Interrupt:5
ifb4pppoe-pppoe Link encap:Ethernet HWaddr 1E:7E:77:58:D5:7B
inet6 addr: fe80::1c7e:77ff:fe58:d57b/64 Scope:Link
UP BROADCAST RUNNING NOARP MTU:1500 Metric:1
RX packets:23918 errors:0 dropped:0 overruns:0 frame:0
TX packets:23918 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:13903602 (13.2 MiB) TX bytes:13903602 (13.2 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:22683 errors:0 dropped:0 overruns:0 frame:0
TX packets:22683 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3422354 (3.2 MiB) TX bytes:3422354 (3.2 MiB)
pppoe-pppoe Link encap:Point-to-Point Protocol
inet addr:xxxxxxxxxxx P-t-P:xxxxxxxxxxx Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST MTU:1492 Metric:1
RX packets:24262 errors:0 dropped:0 overruns:0 frame:0
TX packets:25637 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:13644555 (13.0 MiB) TX bytes:3769276 (3.5 MiB)
15:50:57 root@OpenWrt ~ cat /etc/config/port-mirroring
#
#"target" defines the mirror target, it can be a local interface or a remote ip
#address. For openwrt routers, it shall be remote ip in most case.
#
#"source_ports" defines the mirrored interface, for example, "wlan0" will mirror#all wireless traffic. Multiple interfaces are supported(ie: "wlan0,eth0").
#
config 'port-mirroring'
option 'target' '192.168.1.141'
option 'source_ports' 'pppoe-pppoe'
option 'filter' ''
option 'protocol' 'TZSP'
I use wireshark on 192.168.1.141.If it mirrors these traffic,I should see ip packets which src ip is the ip from pppoe server.but I only get packets which src/dst ip is 192.168.1.x
sorry for my pool english
I think I know why it might not be working but I'll need more information to be sure:
- What is the version number of port-mirroring you're using?
- What is the brand, model, and revision number of your router?
- What version of OpenWrt are you using?
By the way, your English is fine, no need to apologize.
I use port-mirroring_1.4.2_ar71xx which you offered in README.md router band is GL.iNet 6416 openwrt CC,download from https://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/openwrt-15.05-ar71xx-generic-gl-inet-6416A-v1-squashfs-sysupgrade.bin
I'm online, maybe you can use teamviewer or something to directly access my network,just tell me
Thanks for the quick response and you're using the right version of port-mirroring and OpenWrt with your router. I'm reviewing the code and it looks like a bug with port-mirroring. I don't think the original author anticipated using port-mirroring on a virtual network interface such as PPPoE which doesn't appear to have a MAC address or use address resolution protocol. I'll look into it this week but I can't guarantee when I'll be able to fix it.