Chapter 48. Mirroring a network interface by using nmcli

Procedure

1. Add a network connection profile that you want to mirror the network traffic from:

   # nmcli connection add type ethernet ifname enp1s0 con-name enp1s0 autoconnect no

2. Attach a prio qdisc to enp1s0 for the egress (outgoing) traffic with the 10: handle:

   # nmcli connection modify enp1s0 +tc.qdisc "root prio handle 10:"

   The prio qdisc attached without children allows attaching filters.

3. Add a qdisc for the ingress traffic, with the ffff: handle:

   # nmcli connection modify enp1s0 +tc.qdisc "ingress handle ffff:"

4. Add the following filters to match packets on the ingress and egress qdiscs, and to mirror them to enp7s0:

   # nmcli connection modify enp1s0 +tc.tfilter "parent ffff: matchall action mirred egress mirror dev enp7s0"
   
   # nmcli connection modify enp1s0 +tc.tfilter "parent 10: matchall action mirred egress mirror dev enp7s0"

   The matchall filter matches all packets, and the mirred action redirects packets to destination.

5. Activate the connection:

   # nmcli connection up enp1s0

Verification

1. Install the tcpdump utility:

   # yum install tcpdump

2. Display the traffic mirrored on the target device (enp7s0):

   # tcpdump -i enp7s0