[Bridge] Sending 802.1Q packets using AF_PACKET socket on filtered bridge forwards with wrong MAC addresses

Brandon Carpenter brandon.carpenter at cypherpath.com
Tue Nov 28 17:21:17 UTC 2017

While attempting to send ARP DAD packets on a bridge device, I noticed 
that hosts attached to the bridge ports were not responding. After 
digging in with tcpdump/wireshark, I noticed that the MAC addresses of 
the packets (the first 12 bytes of the Ethernet frame) were wrong and 
were an exact duplicate of the following 12 bytes (bytes 13-24), but 
only on slave bridge ports. The bridge device itself had the correct 
addresses. Here is an example setup:

> # ip link add br0 type bridge vlan_filtering 1

Brandon Carpenter | Software Engineer
Cypherpath, Inc.
400 Columbia Point Drive Ste 101 | Richland, Washington USA
Office: (650) 713-3060


CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is 
for the sole use of the intended recipient(s) and may contain proprietary, 
confidential or privileged information or otherwise be protected by law. 
Any unauthorized review, use, disclosure or distribution is prohibited. If 
you are not the intended recipient, please notify the sender and destroy 
all copies and the original message.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bridge/attachments/20171128/76476a86/attachment.html>

More information about the Bridge mailing list