dup-to duplicating packet twice?

Previous Topic Next Topic
classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

dup-to duplicating packet twice?

Simon Kammerer
Hi list!

I'm seeing dup-to duplicating some packets twice while trying to
duplicate all wireless traffic on a bridged access point.

My setup:

mainboard with two onboard NICs (re0, re1) plus PCI wireless adapter (ral0)

re0 and ral0 are bridged:

cat /etc/hostname.re0

cat /etc/hostname.ral0
mediaopt hostap
chan 8
nwid dup
wpaprotos wpa2
wpakey sercretkey

cat /etc/hostname.bridge0
add re0
add ral0

Packets will be duplicated to re1, so I had to give re1 an ip address

cat /etc/hostname.re1

and because I want dup-to to use as destination that does not
exist (re1 is connected to a good old hub, so more than one analysing
host can see the traffic), a static arp entry is used:

arp -s 00:90:27:bb:cc:dd permanent

cat /etc/pf.conf
wlan_if = "ral0"
dup_if = "re1"
dup_adr = ""
ext_if = "re0"


pass in on $wlan_if dup-to ($dup_if $dup_adr)
pass out on $ext_if

Now, when I connect to the wireless network (hostap on ral0) and then
ping a host in the bridged network, I will see one icmp request and one
icmp reply on ral0 (tcpdump -i ral0) as expected, but on re1 (=the
dup-to destination interface) I will see one icmp request but two icmp

The tcpdump timestamp for the second duplicated reply packet is just one
millionth younger than the first duplicated reply packet
(00:00:00.000000 vs 00:00:00.000001).

when I change pf.conf to
pass in on $wlan_if
pass out on $ext_if dup-to ($dup_if $dup_adr)

-> now duplicating all packtes that leave $ext_if instead of duplicating
all packets that enter $wlan_if, the icmp request gets duplicated twice
instead of the rely!

Same thing with dns lookups.

Any ideas if I'm completely misunderstanding the concept of dup-to or
what's going wrong or how to provide more information?