Chapter 44. Configuring network devices to accept traffic from all MAC addresses
Network devices usually intercept and read packets that their controller is programmed to receive. You can configure the network devices to accept traffic from all MAC addresses in a virtual switch or at the port group level.
You can use this network mode to:
- Diagnose network connectivity issues
- Monitor network activity for security reasons
- Intercept private data-in-transit or intrusion in the network
You can enable this mode for any kind of network device, except InfiniBand.
44.1. Temporarily configuring a device to accept all traffic
You can use the ip utility to temporary configure a network device to accept all traffic regardless of the MAC addresses.
Procedure
Optional: Display the network interfaces to identify the one for which you want to receive all traffic:
# ip address show 1: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000 link/ether 98:fa:9b:a4:34:09 brd ff:ff:ff:ff:ff:ff ...Modify the device to enable or disable this property:
To enable the
accept-all-mac-addressesmode forenp1s0:# ip link set enp1s0 promisc onTo disable the
accept-all-mac-addressesmode forenp1s0:# ip link set enp1s0 promisc off
Verification
Verify that the
accept-all-mac-addressesmode is enabled:# ip link show enp1s0 1: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000 link/ether 98:fa:9b:a4:34:09 brd ff:ff:ff:ff:ff:ff
The
PROMISCflag in the device description indicates that the mode is enabled.
44.2. Permanently configuring a network device to accept all traffic using nmcli
You can use the nmcli utility to permanently configure a network device to accept all traffic regardless of the MAC addresses.
Procedure
Optional: Display the network interfaces to identify the one for which you want to receive all traffic:
# ip address show 1: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000 link/ether 98:fa:9b:a4:34:09 brd ff:ff:ff:ff:ff:ff ...You can create a new connection, if you do not have any.
Modify the network device to enable or disable this property.
To enable the
ethernet.accept-all-mac-addressesmode forenp1s0:# nmcli connection modify enp1s0 ethernet.accept-all-mac-addresses yesTo disable the
accept-all-mac-addressesmode forenp1s0:# nmcli connection modify enp1s0 ethernet.accept-all-mac-addresses no
Apply the changes, reactivate the connection:
# nmcli connection up enp1s0
Verification
Verify that the
ethernet.accept-all-mac-addressesmode is enabled:# nmcli connection show enp1s0 ... 802-3-ethernet.accept-all-mac-addresses:1 (true)
The
802-3-ethernet.accept-all-mac-addresses: trueindicates that the mode is enabled.
44.3. Permanently configuring a network device to accept all traffic using nmstatectl
Use the nmstatectl utility to configure a device to accept all traffic regardless of the MAC addresses through the Nmstate API. The Nmstate API ensures that, after setting the configuration, the result matches the configuration file. If anything fails, nmstatectl automatically rolls back the changes to avoid leaving the system in an incorrect state.
Prerequisites
-
The
nmstatepackage is installed. -
The
enp1s0.ymlfile that you used to configure the device is available.
Procedure
Edit the existing
enp1s0.ymlfile for theenp1s0connection and add the following content to it:--- interfaces: - name: enp1s0 type: ethernet state: up accept -all-mac-address: true
These settings configure the
enp1s0device to accept all traffic.Apply the network settings:
# nmstatectl apply ~/enp1s0.yml
Verification
Verify that the
802-3-ethernet.accept-all-mac-addressesmode is enabled:# nmstatectl show enp1s0 interfaces: - name: enp1s0 type: ethernet state: up accept-all-mac-addresses: true ...
The
802-3-ethernet.accept-all-mac-addresses: trueindicates that the mode is enabled.
Additional resources
-
nmstatectl(8)man page on your system -
/usr/share/doc/nmstate/examples/directory
