[Bridge] Error while trying to setup bridge, appears to be a loop

[Stephen Hemminger]

Gary W. Smith wrote:
>
> Hello,
>
> I’ve been trying to implement a bridge in place for a clustered 
> firewall at one of our office locations. Currently we NAT two class 
> C’s internally. We decided, for performance reasons, that it would 
> make sense to put our servers into an official DMZ. So we started this 
> bridging project. Our goal is to have two redundant firewalls in 
> place. There is no need for active/active. The current firewalls are 
> running Linux-HA happily.
>
> We setup a single node and tried to setup a bridge and ran into 
> problems (please note, this isn’t production but rather only testing 
> at this point). Here is our general configuration.
>
> eth0 public, 100mb
>
> eth1 heartbeat for HA, private IP, 100mb
>
> eth2 DMZ, 1GB
>
> eth3 LAN, 1GB
>
> We have setup a fake set of IP’s for our internal environment 
> (58.100.1-31.0 split /24). Interfaces eth0 and eth2 have no IP as they 
> will constitute the bridge, eth3 has 10.0.8.253.
>
> After the machine has started, we login and start the bridge manually. 
> Sitting idle, the bridge will start to spew errors in the message log 
> (logged below) about received packet with own address as source 
> address. Looking around on the net it appears that there is a loop 
> somewhere. Interfaces eth0 and eth2 are on their own switches. We 
> tried using VLAN but put eth2 on it’s own switch to rule out the 
> switch itself.
>
> The errors show in the tcpdump spew as fast as the screen can write 
> 15-30 seconds after I issue an ifconfig DMZ up. On the LAN side we 
> have a single workstation, in the DMZ (or the eth2 side of the DMZ) 
> there is currently nothing.
>
> Any help would be greatly appreciated.
>
> brctl addbr DMZ
>
> brctl addif DMZ eth0
>
> brctl addif DMZ eth2
>
> ifconfig DMZ up
>
> ip addr add 58.100.13.253/24 dev DMZ
>
> route add -net 0/0 gw 58.100.13.1 metric 0
>
>
> ip addr
>
> 1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
>
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>
> inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
>
> inet6 ::1/128 scope host
>
> valid_lft forever preferred_lft forever
>
> 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>
> link/ether 00:07:e9:82:67:2a brd ff:ff:ff:ff:ff:ff
>
> inet6 fe80::207:e9ff:fe82:672a/64 scope link
>
> valid_lft forever preferred_lft forever
>
> 3: eth1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>
> link/ether 00:07:e9:82:67:2b brd ff:ff:ff:ff:ff:ff
>
> inet 10.254.254.253/29 brd 10.254.254.255 scope global eth1
>
> inet6 fe80::207:e9ff:fe82:672b/64 scope link
>
> valid_lft forever preferred_lft forever
>
> 4: eth2: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>
> link/ether 00:04:23:c1:fa:36 brd ff:ff:ff:ff:ff:ff
>
> inet6 fe80::204:23ff:fec1:fa36/64 scope link tentative
>
> valid_lft forever preferred_lft forever
>
> 5: eth3: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
>
> link/ether 00:04:23:c1:fa:37 brd ff:ff:ff:ff:ff:ff
>
> inet 10.0.8.254/24 scope global secondary eth3
>
> inet6 fe80::204:23ff:fec1:fa37/64 scope link
>
> valid_lft forever preferred_lft forever
>
> 6: sit0: <NOARP> mtu 1480 qdisc noop
>
> link/sit 0.0.0.0 brd 0.0.0.0
>
> 7: DMZ: <BROADCAST,MULTICAST> mtu 1500 qdisc noqueue
>
> link/ether 00:04:23:c1:fa:36 brd ff:ff:ff:ff:ff:ff
>
> inet 58.100.13.253/24 scope global DMZ
>
> brctl showstp DMZ
>
> DMZ
>
> bridge id 8000.000423c1fa36
>
> designated root 8000.000423c1fa36
>
> root port 0 path cost 0
>
> max age 19.99 bridge max age 19.99
>
> hello time 1.99 bridge hello time 1.99
>
> forward delay 14.99 bridge forward delay 14.99
>
> ageing time 299.95
>
> hello timer 0.00 tcn timer 0.00
>
> topology change timer 0.00 gc timer 239.83
>
> flags
>
>
> eth0 (2)
>
> port id 8002 state disabled
>
> designated root 8000.000423c1fa36 path cost 19
>
> designated bridge 8000.000423c1fa36 message age timer 0.00
>
> designated port 8002 forward delay timer 0.00
>
> designated cost 0 hold timer 0.00
>
> flags
>
> eth2 (1)
>
> port id 8001 state disabled
>
> designated root 8000.000423c1fa36 path cost 19
>
> designated bridge 8000.000423c1fa36 message age timer 0.00
>
> designated port 8001 forward delay timer 0.00
>
> designated cost 0 hold timer 0.00
>
> flags
>
>
> tcpdump -i eth2
>
> 18:23:28.964574 IP 58.100.13.253.24462 > 239.255.255.250.1900: UDP, 
> length 242
>
> ...
>
> 18:23:28.967746 IP 58.100.13.253.24470 > 239.255.255.250.1900: UDP, 
> length 322
>
>
> /var/log/messages
>
> Feb 14 18:11:08 testfw01b kernel: printk: 3 messages suppressed.
>
> Feb 14 18:11:08 testfw01b kernel: eth2: received packet with own 
> address as source address
>
> Feb 14 18:11:12 testfw01b kernel: printk: 5 messages suppressed.
>
> Feb 14 18:11:12 testfw01b kernel: eth2: received packet with own 
> address as source address
>
Looks like you have multiple ethers all connected on the same wire (and 
spanning tree is off).
In that case packets would end up looping for ever and you would see 
that message.