[script] mirror any device to a dsa device

Router
1

Hello,

Warning technical So I wanted something which could mirror any DSA device to a other existing device.

In my case I wanted to see all traffic on wan mirrored to br-lan.222, so that I can use suricata on it.

it is required to create 802.1Q device inside luci -> network -> interfaces -> devices (tab).

followed by clicking back on the interfaces tab next to devices, create a new interface and use protocol as unmanaged as device you use the newly created br-lan.222, uncheck default gateway, and also uncheck the ipv6 delegation option, save and apply, this is required for the device to be up.

It is important that you configure vlan 222 on a other device as promiscuous mode, this makes it readonly.

This can be archieved by doing (eth0 can differ as network device for wan):

ip link add link eth0 name eth0.222 type vlan id 222
ip link set dev eth0.222 promisc on up

^ or by the way your linux distribution handles persistent network data.

The script requires kmod-sched-core, tc-full, and DSA not swconfig, tc command is part of DSA.

Go to: /usr/bin

create a file named set_mirror and paste in vim:

#!/bin/sh

function createMonitor {


	monitor_iface=$1
	monitor_vlan=$2

	tc qdisc add dev $monitor_iface clsact
	tc filter add dev $monitor_iface ingress matchall action mirred egress mirror dev $monitor_vlan
	tc filter add dev $monitor_iface egress matchall action mirred egress mirror dev $monitor_vlan

}

createMonitor $1 $2

exit 0

now use chmod +x set_mirror.

Now you can do set_mirror eth1.300 br-lan.222 and you can bind multiple devices to the br-lan.222 interface.

Although there is some drawback, it seem some packets can be randomly dropped, but it can also occur that the router crashes after a long time mirroring as example I did a extreme scenario with the full br-lan with more than 12 vlans....

Though I hope it can be usefull to some people :smiley:, it could be usefull to some IDS systems, and perhaps it can even work better with some modifications to my script (tc can be very complicated to understand, I took it from google search ai and it seemed to work).

It is not persistent, you still need to use the set_mirror command at any reboot, but maybe it is better for temporary probes.

3 Likes