Intro
Now I’m into playing with networking stuff on the Pi. So for a small investment I got a USB to ethernet adapter – $25 from Amazon. My first few experiments with it – turning it into a bridge – were largely successful.
The details
You need the bridge-utils package:
$ sudo apt-get install bridge-utils
For me it was easiest to connect to my Pi via the Wifi adapter I have on it (see this post describing how I used that to make a router). Then I could blow up the wired ethernet without disrupting my connection.
The first thing I noticed after plugging in the adapter is that it was automagically recognized and, for instance, the ifconfig -a command now shows an eth1 device. So no device driver needed to be installed, which was pretty sweet.
Listing the USB devices now looks like this:
$ lsusb
Bus 001 Device 002: ID 0424:9512 Standard Microsystems Corp. Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. Bus 001 Device 004: ID 0b95:1780 ASIX Electronics Corp. AX88178 Bus 001 Device 005: ID 7392:7811 Edimax Technology Co., Ltd EW-7811Un 802.11n Wireless Adapter [Realtek RTL8188CUS] |
In short I want to take my two wired ports, eth0 and eth1, bridge them and send real traffic through them to see what happens. Bridging here means connecting two separate networks at a layer-2 level, so MAC addresses are proxied through the bridge and layer-3 communications occur transparently over the bridge as if it weren’t even there.
So…
$ sudo brctl addbr br0
creates a bridge named br0.
$ sudo brctl addif br0 eth0
$ sudo brctl addif br0 eth1
Adds those two physical ports to the bridge.
By the way I got all this from this reliable Linux Foundation source.
Now if I got it right, I should be able to unplug any wired device and put the Pi in between the switch and the device, no matter what its network is!
So I plugged my PC into one port, the other port into the switch the PC had been plugged into, and…
Well, for instance, showmacs output looks like this:
$ sudo brctl showmacs br0
port no mac addr is local? ageing timer 1 00:00:00:0c:c8:1f no 1.30 1 00:01:00:02:c8:1f no 197.23 2 00:02:cf:80:cc:99 no 0.07 2 00:90:a9:bb:3d:76 no 0.94 1 5e:00:00:fb:c8:1f no 134.11 1 5e:00:00:fd:c8:1f no 57.49 1 5e:7f:ff:fa:c8:1f no 29.55 2 64:66:b3:3b:bd:51 no 12.34 1 8c:ae:4c:ff:27:69 yes 0.00 2 b8:27:eb:dd:21:03 yes 0.00 1 c8:1f:66:00:63:fe no 0.15 |
00:02:cf:80:cc:99 belongs to my upstream router, which is plugged into eth0, so I conclude that port 2 is eth0 and port 1 must be eth1. Maybe the port number was determined by the order in which I added the interface to the bridge?
Then I ran speedtest on my PC – there was no measurable slowdown in speed.
I loaded up the Pi with a cpu-intensive job:
$ yes > /dev/null
and re-ran speedtest. Still no hit to performance.
A brief review
I don’t think everyone will have appreciated what we’ve accomplished so let me review. We have created a passive, stealth man-in-the-middle (MITM) device with a management interface!
There are lots of uses for that, some not so noble. A more nefarious usage would be to connect up to a device and record all traffic passing back and forth to it (tcpdump -i br0). But there are also lots of good things we can achieve as well. For instance, Intrusion Detection System or Intrusion Prevention System (IDS/IPS). Firewall. Transparent proxy filter. IDS/IPS may be possible with Snort. I have to ask one of my security pals if that’s still the popular open source choice for IPS. Five years ago it was the package of choice.
What’s on my plate
Now I’d like to tinker with the Pi so that I can in fact slow down traffic and emulate slower connections! But I don’t know how yet…
I need to show how to make the bridging permanent using /etc/network/interfaces file.
To be continued…