Filtering arp on vlan trunk interface

Hi,

I'm trying to filter arp broadcast packets from a specific mac address
(0:0e:15:33:9f:1b) on interface vlan111.

But I'm not sure if this issue is related to the item "ip/arp/etc over vlan
filtering" in the todo list?


The bridge looks likes this:


br0             0001.00e081111112       yes             eth2
                                                        vlan111  (@eth3)


When adding these rules to the INPUT and FORWARD chain, the counter values
raise, so it looks like packets are dropped.

-A INPUT -p ARP --logical-in br0 --arp-mac-src 0:0e:15:33:9f:1b -j DROP , pcnt =
2211 -- bcnt = 101706

-A FORWARD -p ARP --logical-in br0 --arp-mac-src 0:0e:15:33:9f:1b -j DROP , pcnt
= 6876 -- bcnt = 316296

I also added these rules with "-i vlan111" instead of "--logical-in br0".


Using 'brctl showmacs br0' I grep for the mac address. It's not dissappearing,
but instead, everytime a packet is dropped in the chain (I'm running 'watch -n1
-d ebtables -L --Lc') the ageing timer for that mac gets refreshed.

So is this related to the todo "ip/arp/etc over vlan filtering"?

How would I be able to filter such an arp request, so that it's not added to the
bridge mac table?

Tcpdump also sees the arp packets coming in, this wouldn't be happening if the
ARP packets would have been filtered, right?

0:0e:15:33:9f:1b > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp
who-has xx.xx.xx.3 tell xx.xx.xx.1

I'm running Kernel 2.6.22.5 + Bridge + ebtables

Thanks in advance,

Lars


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/