Ebtables oddities - inconsistancies - and overall confusion ?

Alex.Upton-ppgqtt2TIWRWk0Htik3J/[email protected] Thu, 10 May 2007 12:08:19 -0400
Newsgroups gmane.linux.network.bridge.ebtables.user
Message-ID <OF2183492F.C5F23DC4-ON852572D7.00564A00-852572D7.0058A746@instinet.com>
Hello All,

I'm hoping someone can point me in the right direction, I've setup 
ebtables to handle multicast routing a few years ago and I believe my 
configuration is correct, however I don't appear to be seeing any 
multicast joins going out my source interface.

I have provided my current config info below, hopefully this is enough to 
explain the problem, but in short I can see the incoming packet and byte 
count increasing for my source interface, however I do not see any active 
joins go out the source interface, nor do the counters of the destination 
interface increase.

Both source and destination interfaces are patched into separate switches. 
The source interface is patched into a vlan where the multicast address of 
 239.255.45.140 is quite active. The destination interface is patched into 
separate dedicated switch with out any clients. Basically this was done to 
force the destination interface to have an active link.

When using a loopback on the destination interface it caused the data I 
was reading to flood back through the bridged source interface until 
ebtables was started and a DROP on all outbound IPV4 traffic for the 
source interface was set.

Any help in figuring out what's wrong would be greatly appreciated.

Thanks
-Alex


OS: Fedora Core 6
Kernel : 2.6.20-1.2948.fc6
Interfaces:
eth0 = administrative non-bridged port
eth1 = bridged destination port
eth2 = bridged source port
eth3 = unused - non-bridged port
bridge-utils-1.1-2
ebtables-2.0.8-0.8.rc3.fc6

lsmod output:
        ebtable_broute          6337  0
        ebtable_nat             6593  0
        ebt_log                 8257  5
        ebt_ip                  6337  6
        ebtable_filter          6593  1
        ebtables               22465  5 
ebtable_broute,ebtable_nat,ebt_log,ebt_ip,ebtable_filter
        bridge                 53465  1 ebtable_broute


Ethtool output for bridged interfaces:
        ethtool eth1|grep Link
                Link detected: yes

        ethtool eth2|grep Link
                Link detected: yes

Startup:
        ebtables -F
        ebtables -Z
        ebtables -P INPUT DROP
        ebtables -P OUTPUT DROP
        ebtables -P FORWARD DROP

        ebtables -A FORWARD -p IPv4 --ip-proto igmp -j DROP

        ebtables -N TEST
        ebtables -P TEST RETURN
        ebtables -A TEST -p IPv4 --in-if eth2 --log --ip-dst 
239.255.45.140 -j ACCEPT

        # Removing the bridge
        ifconfig br0 down
        brctl delif br0 eth1
        brctl delif br0 eth2
        brctl delbr br0

        echo [ Creating the bridge between eth1 and eth2 ]
        brctl addbr br0
        brctl stp br0 off
        brctl addif br0 eth1
        brctl addif br0 eth2

        # Enable forwarding to br0
        ebtables -A FORWARD --in-if eth2 --out-if eth1 -j WMD

        # Bringing up the bridge
        ifconfig br0 up

        # Print ebtables counter stats
        sleep 1
        ebtables -L --Lc

Startup list and counter output:
        Bridge table: filter

        Bridge chain: INPUT, entries: 0, policy: DROP

        Bridge chain: FORWARD, entries: 2, policy: DROP
        -p IPv4 --ip-proto igmp -j DROP , pcnt = 8 -- bcnt = 224
        -i eth2 -o eth1 -j WMD, pcnt = 721 -- bcnt = 40186

        Bridge chain: OUTPUT, entries: 0, policy: DROP

        Bridge chain: WMD, entries: 5, policy: RETURN
        -p IPv4 -i eth2 --ip-dst 239.255.45.140 --log-level notice 
--log-prefix "" -j ACCEPT , pcnt = 0 -- bcnt = 0


*****************************************************************
<<<Disclaimer>>>

In compliance with applicable rules and regulations, Instinet
reviews and archives incoming and outgoing email communications,
copies of which may be produced at the request of regulators.
This message is intended only for the personal and confidential
use of the recipients named above.  If the reader of this email
is not the intended recipient, you have received this email in
error and any review, dissemination, distribution or copying is
strictly prohibited. If you have received this email in error,
please notify the sender immediately by return email and
permanently delete the copy you received.  

Instinet accepts no liability for any content contained in the
email, or any errors or omissions arising as a result of email
transmission. Any opinions contained in this email constitute
the sender's best judgment at this time and are subject to change
without notice.   Instinet does not make recommendations of a
particular security and the information contained in this email
should not be considered as a recommendation, an offer or a
solicitation of an offer to buy and sell securities.

*****************************************************************

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/

_______________________________________________
Ebtables-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-user