Sample Header Ad - 728x90

Creating a port mirror on the open vswitch bridge

1 vote
2 answers
4635 views
I have been trying to configure port mirror on Virtual bridge created using open vswitch. I have created the following ports on Bridge demo_bridge using: sudo ovs-vsctl add-port demo_bridge victim0 Bridge demo_bridge Port "demo_bridge" Interface demo_bridge type: internal Port "victim0" Interface victim0 type: internal Port "attacker0" Interface attacker0 type: internal Port "wireshark0" Interface wireshark0 type: internal ovs_version: "2.5.2" I am conducting a simple experiment where VM1 (attached to attacker0) is going to attack VM2 (attached to victim0), and I need to mirror all traffic from attacker0 vport to wireshark0 (VM3 capturing network traffic). However, whenever I enable mirroring, I can no longer ping from VM1 (Attacker VM) to VM3 (Wireshark VM); furthermore I cannot see any mirrored traffic on VM3 either. These are the two set of commands I have used to create mirror port, and none of them work: sudo ovs-vsctl \ -- set Bridge demo_bridge mirrors=@m1 \ -- --id=@attacker0 get Port attacker0 \ -- --id=@wireshark0 get Port wireshark0 \ -- --id=@m1 create Mirror name=port_mirror1 select-dst-port=@attacker0 select-src-port=@attacker0 output-port=@wireshark0 //From YOUTUBE Video sudo ovs-vsctl \ -- --id=@p get port victim0 \ -- --id=@m create mirror name=mirror0 \ -- add bridge demo_bridge mirrors @m \ -- set mirror mirror0 output_port=@p //Activate the mirror sudo ovs-vsctl \ -- --id=@p get port ens3 \ -- set mirror mirror0 select_dst_port=@p \ -- set mirror mirror0 select_src_port=@p These commands do create the mirror port, but they also break the network connection between the attacker VM1 and victim VM2. When the mirror is removed, I can ping to all VM just fine. The local interface on each VM (ens3) has a static IP addresses connected to the Bridge demobridge. /etc/network/interfaces auto ens3 iface ens3 inet static address 172.168.0.3 network 172.168.0.0/27 netmask 255.255.255.0
Asked by user3797683 (11 rep)
Mar 3, 2018, 09:24 AM
Last activity: Jun 13, 2025, 08:02 PM