Mirror one eth interface to another

[seamant]

Hello! I encountered the following problem. I’m setting up a virtual laboratory that should have the following topology

192.168.1.3 - user virtual machine.
192.168.2.5 - virtual machine with Snort and Wireshark (Monitor)

I want to monitor all traffic from eth1 using a virtual machine with Wireshark

I have configured VyOS interfaces. VyOS sees both virtual machines. The user virtual machine is configured with port forwarding so that it can access the Internet via VyOS.
I’m using VyOS 1.2.9, port configuration is below:

However, Wireshark does not see any packets on the interface that connects VyOS and the monitor virtual machine

Maybe I should change the way I send traffic?

[blex]

My best guess would be put both interface in a bridge.

[blex]

512×512 6.76 KB

Hello Everyone On the VyOS Feature List webpage (http://vyos.net/wiki/Feature_list) port mirroring is listed under “Network interfaces.” So far I have not been able to find any documentation on how to do this though. Can someone here describe how to do this or point me to a webpage that explains it? Thanks!

I think this is the solution You where serchin.

BG Alexander

[seamant]

@blex Port mirroring already configured (VyOS config screenshot), but still there is no packages

[Viacheslav]

Check the dump on VyOS site
“monitor traffic interface ethX”
Maybe old 1.2.9 had some bugs

[seamant]

I thought for a bit. If I ping monitor IP - Wireshark sees these packets. It looks like they came from the VyOS interface, since they had a destination address that matches the address of the monitor. Then how can I force the VyOS interface to forward ALL traffic that comes to this interface to the monitor’s IP address?

At the same time, I need to save the original source address and destination address

[JeffWDH]

When I want to monitor an interface I usually do something like this from the PC that has Wireshark installed:

Windows:
ssh user@vyos sudo tcpdump -i eth1.105 -U -s0 -w - 'not port 22' | "C:\Program Files\Wireshark\Wireshark.exe" -k -i -

Linux:
ssh user@vyos sudo tcpdump -i eth0 -U -s0 -w - 'not port 22' | wireshark -k -i -

You can add to the filters too if you want to exclude more traffic, ie. ‘not port 22 and dst 192.168.1.5 or src 192.168.1.5’

[16again]

Look at your hypervisor settings. Could be sending packets originating from different MAC addresses than NIC itself is blocked

[seamant]

Thanks! I changed the settings in the hypervisor and the packets became visible when using Wireshark