Chapter 48. Mirroring a network interface by using nmcli

Procedure

1. Add a network connection profile that you want to mirror the network traffic from:

   # nmcli connection add type ethernet ifname enp1s0 con-name enp1s0 autoconnect no

   Copy to Clipboard Toggle word wrap

2. Attach a qdisc of type prio to enp1s0 for the egress (outgoing) traffic with the 10: handle:

   # nmcli connection modify enp1s0 +tc.qdisc "root prio handle 10:"

   Copy to Clipboard Toggle word wrap

   The qdisc set to prio attached without children allows attaching filters.

3. Add a qdisc for the ingress traffic, with the ffff: handle:

   # nmcli connection modify enp1s0 +tc.qdisc "ingress handle ffff:"

   Copy to Clipboard Toggle word wrap

4. Add the following filters to match packets on the ingress and egress qdiscs, and to mirror them to enp7s0:

   # nmcli connection modify enp1s0 +tc.tfilter "parent ffff: matchall action mirred egress mirror dev enp7s0"
   
   # nmcli connection modify enp1s0 +tc.tfilter "parent 10: matchall action mirred egress mirror dev enp7s0"

   Copy to Clipboard Toggle word wrap

   The matchall filter matches all packets, and the mirred action redirects packets to destination.

5. Activate the connection:

   # nmcli connection up enp1s0

   Copy to Clipboard Toggle word wrap

Verification

1. Install the tcpdump utility:

   # yum install tcpdump

   Copy to Clipboard Toggle word wrap

2. Display the traffic mirrored on the target device (enp7s0):

   # tcpdump -i enp7s0

   Copy to Clipboard Toggle word wrap