Mdthbs

I have been trying to configure port mirror on Virtual bridge created using open vswitch.

I have created the following ports on Bridge demo_bridge using:

sudo ovs-vsctl add-port demo_bridge victim0



Bridge demo_bridge

   Port "demo_bridge"

       Interface demo_bridge

           type: internal

   Port "victim0"

       Interface victim0

           type: internal

   Port "attacker0"

       Interface attacker0

           type: internal

   Port "wireshark0"

       Interface wireshark0

           type: internal

ovs_version: "2.5.2"

I am conducting a simple experiment where VM1 (attached to attacker0) is going to attack VM2 (attached to victim0), and I need to mirror all traffic from attacker0 vport to wireshark0 (VM3 capturing network traffic). However, whenever I enable mirroring, I can no longer ping from VM1 (Attacker VM) to VM3 (Wireshark VM); furthermore I cannot see any mirrored traffic on VM3 either.

These are the two set of commands I have used to create mirror port, and none of them work:

sudo ovs-vsctl  

-- set Bridge demo_bridge mirrors=@m1  

-- --id=@attacker0 get Port attacker0  

-- --id=@wireshark0 get Port wireshark0  

-- --id=@m1 create Mirror name=port_mirror1 select-dst-port=@attacker0 select-src-port=@attacker0 output-port=@wireshark0

//From YOUTUBE Video

sudo ovs-vsctl  

-- --id=@p get port victim0  

-- --id=@m create mirror name=mirror0  

-- add bridge demo_bridge mirrors @m  

-- set mirror mirror0 output_port=@p 

//Activate the mirror

sudo ovs-vsctl 

-- --id=@p get port ens3 

-- set mirror mirror0 select_dst_port=@p 

-- set mirror mirror0 select_src_port=@p  

These commands do create the mirror port, but they also break the network connection between the attacker VM1 and victim VM2. When the mirror is removed, I can ping to all VM just fine. The local interface on each VM (ens3) has a static IP addresses connected to the Bridge demobridge. /etc/network/interfaces

auto ens3

iface ens3 inet static

address 172.168.0.3

network 172.168.0.0/27

netmask 255.255.255.0

Have you tried using tcpdump to listen on the interface of the vm?

I'm not sure what you are using as a hypervisor, but you should be able to run ip addr, and if you can see the ports of the vswitch; in that output you can capture on those ports in tcpdump.

You can also run tcpdump -D, and that will tell you what libpcap is aware of on the host machine for capturing.

For example if you are running KVM as the hypervisor you can get the mac address and name of the port the vm is associated with.

# Assuming your xml files for the vms are in the default location also.
cat /etc/libvirt/qemu/{{ name_of_vm }}.xml | grep -A 2 interface

From this output you can match up the output from ip addr using the last two digits from the mac address as a filter.

ip a | grep -B 1 -i {{ last_two }}

The interface that is returned can then be used by tcpdump.

tcpdump -ni {{ vnet_name }} -s0 -vw /var/tmp/{{ vnet_port_out }}.pcap

This will capture everything on that port unfiltered.

I have the same question, this my test case:

use vm3's NIC to receive ovs traffic, after set mirror vm3 break network and can not reveive mirror traffic.

I found this image show what between ovs port and vm nic

use ifconfig can see the above image say qbr qvb qvo tap

use tcpdump captrue qbrxxx,qvoxxx,qvbxxx,tapxxx, can see only tapxxx can not reveive mirror traffic(have set 4 nic promisc)