Skip to content
This repository has been archived by the owner on Mar 23, 2024. It is now read-only.

If it works on pppoe? #44

Open
wen-long opened this issue Nov 21, 2015 · 3 comments
Open

If it works on pppoe? #44

wen-long opened this issue Nov 21, 2015 · 3 comments

Comments

@wen-long
Copy link

I try to mirror the traffic on a pppoe network but receive nothing
and --debug shows no error

details:

15:49:03 root@OpenWrt ~ ifconfig
br-lan    Link encap:Ethernet  HWaddr AA:AA:AA:11:11:11
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fdf9:5c46:674e::1/60 Scope:Global
          inet6 addr: 2001:470:1f19:1b5::1/64 Scope:Global
          inet6 addr: fe80::e695:6eff:fe40:2133/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:62878 errors:0 dropped:0 overruns:0 frame:0
          TX packets:63097 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:6352932 (6.0 MiB)  TX bytes:19405120 (18.5 MiB)

eth0      Link encap:Ethernet  HWaddr E4:95:6E:40:21:33
          inet addr:100.64.215.143  Bcast:100.64.255.255  Mask:255.255.0.0
          inet6 addr: fe80::e695:6eff:fe40:2133/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:1219431 errors:0 dropped:995 overruns:0 frame:0
          TX packets:954829 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1308812165 (1.2 GiB)  TX bytes:99050584 (94.4 MiB)
          Interrupt:4

eth1      Link encap:Ethernet  HWaddr E4:95:6E:40:21:33
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1214169 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1093214 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:460244586 (438.9 MiB)  TX bytes:1203312990 (1.1 GiB)
          Interrupt:5

ifb4pppoe-pppoe Link encap:Ethernet  HWaddr 1E:7E:77:58:D5:7B
          inet6 addr: fe80::1c7e:77ff:fe58:d57b/64 Scope:Link
          UP BROADCAST RUNNING NOARP  MTU:1500  Metric:1
          RX packets:23918 errors:0 dropped:0 overruns:0 frame:0
          TX packets:23918 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:13903602 (13.2 MiB)  TX bytes:13903602 (13.2 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:22683 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22683 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:3422354 (3.2 MiB)  TX bytes:3422354 (3.2 MiB)

pppoe-pppoe Link encap:Point-to-Point Protocol
          inet addr:xxxxxxxxxxx  P-t-P:xxxxxxxxxxx  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP PROMISC MULTICAST  MTU:1492  Metric:1
          RX packets:24262 errors:0 dropped:0 overruns:0 frame:0
          TX packets:25637 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:13644555 (13.0 MiB)  TX bytes:3769276 (3.5 MiB)
15:50:57 root@OpenWrt ~ cat /etc/config/port-mirroring
#
#"target" defines the mirror target, it can be a local interface or a remote ip
#address. For openwrt routers, it shall be remote ip in most case.
#
#"source_ports" defines the mirrored interface, for example, "wlan0" will mirror#all wireless traffic. Multiple interfaces are supported(ie: "wlan0,eth0").
#

config 'port-mirroring'
    option 'target' '192.168.1.141'
    option 'source_ports' 'pppoe-pppoe'
    option 'filter' ''
    option 'protocol' 'TZSP'

I use wireshark on 192.168.1.141.If it mirrors these traffic,I should see ip packets which src ip is the ip from pppoe server.but I only get packets which src/dst ip is 192.168.1.x

sorry for my pool english

@mmaraya mmaraya self-assigned this Nov 21, 2015
@mmaraya
Copy link
Owner

mmaraya commented Nov 21, 2015

I think I know why it might not be working but I'll need more information to be sure:

  1. What is the version number of port-mirroring you're using?
  2. What is the brand, model, and revision number of your router?
  3. What version of OpenWrt are you using?

By the way, your English is fine, no need to apologize.

@wen-long
Copy link
Author

I use port-mirroring_1.4.2_ar71xx which you offered in README.md
router band is GL.iNet 6416
openwrt CC,download from https://downloads.openwrt.org/chaos_calmer/15.05/ar71xx/generic/openwrt-15.05-ar71xx-generic-gl-inet-6416A-v1-squashfs-sysupgrade.bin

I'm online, maybe you can use teamviewer or something to directly access my network,just tell me

@mmaraya mmaraya added the bug label Nov 21, 2015
@mmaraya
Copy link
Owner

mmaraya commented Nov 21, 2015

Thanks for the quick response and you're using the right version of port-mirroring and OpenWrt with your router. I'm reviewing the code and it looks like a bug with port-mirroring. I don't think the original author anticipated using port-mirroring on a virtual network interface such as PPPoE which doesn't appear to have a MAC address or use address resolution protocol. I'll look into it this week but I can't guarantee when I'll be able to fix it.

@mmaraya mmaraya removed their assignment Dec 1, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants