This patch to if_bridge(4) allows the use of the 'link0' or 'link1' interface options to control whether the bridge forwards all packets or just packets with VLAN tags or just packets without VLAN tags (vlan 0?).
Use 'ifconfig bridge0 link0' to make a bridge forward only untagged packets, leaving the tagged packets to be forwarded or processed separately, by other bridges or cloned interfaces.
Fix: Patch attached with submission follows:
Over to maintainer(s).
I'm attaching my semi-related feature request to P Kern's request from
Allow if_bridge to "normalise" frames before sending them to bpf, to
simplify (and sometimes correctify) traffic sniffing and network
How do I get in touch with a developer that can make this feature find
its way into FreeBSD base? What would it cost me and how soon could it be
I create a bridge0 interface using (one or) multiple parent NICs. Then I
sniff the traffic on this cloned NIC, 'tcpdump -nli bridge0 port 80'.
Multiple NICs are bonded together and can easily be sniffed on ONE
interface with ONE sniffer process.
If the sniffer use a bpf filter like "port 80", and the incoming mirrored
traffic consist of a mix of untagged and vlan tagged (802.1q) packets,
only the untagged packets will match. To see if there are any www-traffic
in the mirrored vlans, one need to change the filter to "vlan and port
80", but then you loose the untagged lan. ...a catch 22. :-(
The file sys/net/if_bridge.c prior to revision 186365
the function call BPF_MTAP to send a copy of a packet to bpf. Since this
gave a stripped packet to the sniffer rather than the full and correct frame,
this bug was corrected in revision 186365 using ETHER_BPF_MTAP.
My request is simply to have the possibility to override the defaults
and do it the "buggy" way again, since this proved to be a great feature
rather than a bug. :-)
Having a function that simply strips off any vlan tag from tagged packets
is wonderful when it comes to sniffing. Especially since switches from all
brands behave differently when it comes to SPAN and vlan tags (a SYN
packet could be mirrorred untagged while the corresponding SYN+ACK is
mirrored with a vlan tag set). It is also quite common that net admins
configure uplink ports with multiple vlans AND an untagged lan. When you
SPAN this uplink you get both tagged and untagged traffic in a mix, making
it hard to work with one bpf filter on the full scope of the received
By normalising the mirrored traffic sent to bpf, a network technician can
more easily perform his network debugging. Also, there are less risk of
human mistakes due to the lack of insight that he need to use the
'vlan' keyword in his tcpdump/tshark/ngrep/whatever to match the traffic.
Also state-keeping tools like snort and argus benefit from normalised
traffic since they fail to build a correct state table if the SYN and
SYN+ACK belong to two different vlans.
My request is that if a sysctl variable (like
net.link.bridge.bpf.strip_header) is true, then if_bridge will pass
stripped packets to bpf. By default it should naturally pass
the full frame.
PS. There are only four places in if_bridge.c that need to be updated to
something like this, so the actual work to do is pretty simple:
if (net.link.bridge.bpf.strip_header == 1)
For bugs matching the following criteria:
Status: In Progress Changed: (is less than) 2014-06-01
Reset to default assignee and clear in-progress tags.
Mail being skipped