search

Erik-Lamers1 / vnet-manager

Virtual network manager - Manages containers and VMs to create a virtual network setup
MIT License
11 stars 7 forks source link

VNet-Manager sniffers cant sniff L2 traffic, cannot reconfigure sniffers for other interfaces #37

Closed SyntheticOxygen closed 12 months ago

SyntheticOxygen commented 2 years ago

During analysis of STP with wireshark I stumbled on the following problems in vnet-manager.

When I try to analyze the PCAPs for the vnet-bridges in the stp_example.yaml configuration I only see L3 traffic, where I also expected to see STP messages.

vnet-manager create config/stp_example.yaml vnet-manager --sniffer start config/stp_example.yaml

The resulting pcaps are then only showing L3 broadcast traffic (i.e. ipv6 neighbour sollicitations).

When I capture manually on for instance vnet-veth0, vnet-veth2 and vnet-veth4 it does show me L2 traffic, but those interfaces are not available before the topology is ran. If I up them with

ip link set dev vnet-veth0 up

and start sniffing, tcpdump breaks as vnet-manager brings those interfaces down and up again.

Is there anyway to configure the sniffers to capture L2 traffic, and to start the sniffers before the topology is fully started to prevent missing traffic?

Kind regards, Vincent

Erik-Lamers1 commented 2 years ago

When taking a quick look at the order of actions here I can see that the veth interfaces are started after the normal bridges. This might be the cause of the missing info. Also, it might be necessary to create sniffers on the veth interfaces as well, in order to see this type of traffic. I would have to check this out in a test environment to confirm.