Bug 203715 - [pf] 'dup-to' option doesn't duplicate packets
Summary: [pf] 'dup-to' option doesn't duplicate packets
Status: Closed Overcome By Events
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-pf (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-12 08:55 UTC by Miłosz Kaniewski
Modified: 2019-02-01 13:41 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Miłosz Kaniewski 2015-10-12 08:55:23 UTC
uname -a:
FreeBSD freebsd11_master.kvm 11.0-CURRENT FreeBSD 11.0-CURRENT #0 r285616: Thu Jul 16 02:21:59 UTC 2015     root@releng2.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC  amd64


+----------+        +-----------+        +----------+
|          |     em0|           |em1     |          |
|  host1   +--------+  FreeBSD  +--------+  host2   |
|          |        |           |        |          |
+----------+        +-----------+        +----------+
                          |em2                      
                          |                         
                          |                         
                          v 

I have FreeBSD machine which forwards packets between host1 and host2. This machine has also an additional interface (em2) which act as span interface - all traffic between host1 and host2 is copied into it.
To achieve this scenario I can set bridge with em0 and em1 as members and em2 as span interface. But I would like to get same result using pf instead. So I tried to use this rules:

pass out on em0 dup-to em2 no state
pass out on em1 dup-to em2 no state

But it doesn't work. No packets appear on interface em2. I've checked same configuration on OpenBSD (version 5.7) and everything worked well.
Comment 1 Kristof Provost freebsd_committer freebsd_triage 2019-02-01 13:41:36 UTC
FreeBSD 11.0 is no longer supported. If this problem can be reproduced on 12.0 or 11.2 please re-open this bug, ideally with a reproduction script.