Netgraph causing duplicated packets on Ethernet

T

tommyj27

I am experiencing unexpected (to me) behavior, using netgraph on an ethernet segment with three hosts. The segment in question is a VirtualBox segment (Internal Network type, promiscuous mode allowed) with three FreeBSD 10.0 hosts acting as routers. My goal is to obtain Netflow data from each of them. Given the following configuration on each host:

Code: 
ngctl mkpeer em0: tee lower right
ngctl name em0:lower em0T
ngctl connect em0: em0T: upper left
ngctl mkpeer em0T: netflow right2left iface0
ngctl name em0T:right2left  netflow1

It seems that hosts are re-transmitting packets received on the segment, if they are not the actual destination. For example, If I ping from host A to host B, host C also sees the echo request (due to the VBox promiscuous mode). Host C re-frames the request and sends it back out the ethernet interface, resulting in host B replying twice.

Is there some bit of configuration I may have overlooked that will prevent this behavior? Turning off promiscuous mode (in VirtualBox) is not possible, as two of the hosts are also using CARP.
 
I've actually noticed this with many devices. When running Wireshark, my Windows box does this, I also see Dell, Belkin, Asus, Linksys, Apple routers doing this. Along with iPads, Desktop Macs, and several other devices.

It's quite interesting what Wireshark can pick up on my ISP's network. My ISP does not block broadcasts. Kind of scary, because I also see uPNP broadcasts and IPv6 gateway discovery traffic hitting my WAN.
 
If it were just ICMP ECHOs that duplicated, it wouldn't be a big problem. But ALL packets are duplicated, and a lot of ICMP redirects generated, resulting in a lot of extra load.
 
I wish you luck. I know there is an option somewhere because this isn't an issue with running Linux, FreeBSD, or Windows in "router mode". Only when they are clients.
 
You must log in or register to reply here.
Back
Top