Creating a port mirror on the open vswitch bridge
1
vote
2
answers
4635
views
I have been trying to configure port mirror on Virtual bridge created using open vswitch.
I have created the following ports on Bridge demo_bridge using:
sudo ovs-vsctl add-port demo_bridge victim0
Bridge demo_bridge
Port "demo_bridge"
Interface demo_bridge
type: internal
Port "victim0"
Interface victim0
type: internal
Port "attacker0"
Interface attacker0
type: internal
Port "wireshark0"
Interface wireshark0
type: internal
ovs_version: "2.5.2"
I am conducting a simple experiment where VM1 (attached to attacker0) is going to attack VM2 (attached to victim0), and I need to mirror all traffic from attacker0 vport to wireshark0 (VM3 capturing network traffic). However, whenever I enable mirroring, I can no longer ping from VM1 (Attacker VM) to VM3 (Wireshark VM); furthermore I cannot see any mirrored traffic on VM3 either.
These are the two set of commands I have used to create mirror port, and none of them work:
sudo ovs-vsctl \
-- set Bridge demo_bridge mirrors=@m1 \
-- --id=@attacker0 get Port attacker0 \
-- --id=@wireshark0 get Port wireshark0 \
-- --id=@m1 create Mirror name=port_mirror1 select-dst-port=@attacker0 select-src-port=@attacker0 output-port=@wireshark0
//From YOUTUBE Video
sudo ovs-vsctl \
-- --id=@p get port victim0 \
-- --id=@m create mirror name=mirror0 \
-- add bridge demo_bridge mirrors @m \
-- set mirror mirror0 output_port=@p
//Activate the mirror
sudo ovs-vsctl \
-- --id=@p get port ens3 \
-- set mirror mirror0 select_dst_port=@p \
-- set mirror mirror0 select_src_port=@p
These commands do create the mirror port, but they also break the network connection between the attacker VM1 and victim VM2. When the mirror is removed, I can ping to all VM just fine. The local interface on each VM (ens3) has a static IP addresses connected to the Bridge demobridge. /etc/network/interfaces
auto ens3
iface ens3 inet static
address 172.168.0.3
network 172.168.0.0/27
netmask 255.255.255.0
Asked by user3797683
(11 rep)
Mar 3, 2018, 09:24 AM
Last activity: Jun 13, 2025, 08:02 PM
Last activity: Jun 13, 2025, 08:02 PM