BBB as network sniffer

GoogleGroups
1

Hi,

I’ve found that AM335x processors did’t implement “promiscuous” mode for eth0 ethernet driver “TI CPSW” and the message which kernel throws is “Promiscuous mode ignored!”. Also, if i run tcpdump (on usb0 port) which is usb client on BBB, devices can enter in promisc mode.

Maybe somebody had any experience with USB-to-RJ45 adapters, which could be connected to usb host port on BBB and utilize it as network sniffer port?

br
Milan

2

I can bring up the Ethernet adapter in promisc mode just fine. Though I
do not use Ubuntu or Debian..

Should be as simple as

ip link set dev eth0 promisc on

Or the equivilent for your OS. If you're on systemd you can easily set
it to do this at boot with
ExecStart=/usr/bin/ip link set dev %i promisc on

this brings you from output like this.. snipped
eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast

to this with it on.. snipped
eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfif

Have no issues with Kernel or anything. Tested on 3.8.13 and 3.12.8 with
Arch

3

That’s great news :slight_smile: I’ll try with Arch and post feedback (http://archlinuxarm.org/platforms/armv7/ti/beaglebone-black).

I’ve tried with both of those kernel versions, though it was pre-compiled rcn Ubuntu image. Actually, when i enter promisc mode, ip output shows me PROMISC flag on, but kernel log prints out that the same one is ignored :slight_smile:
As it turned out, i’ve found snippet of source code which actually confirms it (but it’s also one year old).

static void cpsw_ndo_change_rx_flags(struct net_device *ndev, int flags)
{
        /*
         * The switch cannot operate in promiscuous mode without substantial
         * headache.  For promiscuous mode to work, we would need to put the
         * ALE in bypass mode and route all traffic to the host port.
         * Subsequently, the host will need to operate as a "bridge", learn,
         * and flood as needed.  For now, we simply complain here and
         * do nothing about it :-)
         */
        if ((flags & IFF_PROMISC) && (ndev->flags & IFF_PROMISC))
                dev_err(&ndev->dev, "promiscuity ignored!\n");

        /*
         * The switch cannot filter multicast traffic unless it is configured
         * in "VLAN Aware" mode.  Unfortunately, VLAN awareness requires a
         * whole bunch of additional logic that this driver does not implement
         * at present.
         */
        if ((flags & IFF_ALLMULTI) && !(ndev->flags & IFF_ALLMULTI))
                dev_err(&ndev->dev, "multicast traffic cannot be filtered!\n");
}
4

[Update]

No luck with Arch as well. I installed arch (http://archlinuxarm.org/platforms/armv7/ti/beaglebone-black), kernel v3.8.13 and same issue.

– snip –
[root@alarm ~]# uname -a
Linux alarm 3.8.13-15-ARCH #1 SMP Thu Jan 23 18:33:43 MST 2014 armv7l GNU/Linux

[root@alarm ~]# ip link set dev eth0 promisc on
[ 1042.778670] net eth0: Ignoring Promiscuous mode

[root@alarm ~]# ip link show eth0
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
– snip –

5

I think its a pebkac problem uname -a Linux adminempire-bbb 3.8.13-16-ARCH #1 SMP Thu Feb 6 16:07:54 MST 2014 armv7l GNU/Linux [root@adminempire-bbb ~]# ip link set dev eth0 promisc on [root@adminempire-bbb ~]# ip link show eth0 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000 link/ether c8:a0:30:b0:b5:28 brd ff:ff:ff:ff:ff:ff Again not a single issue on my BBB I can paste any other tests you want me to.

6

I think its a pebkac problem

Well, that might be, but since anything can be fixed, that can as well :slight_smile:

uname -a
Linux adminempire-bbb 3.8.13-16-ARCH #1 SMP Thu Feb 6 16:07:54 MST 2014 armv7l GNU/Linux
[root@adminempire-bbb ~]# ip link set dev eth0 promisc on
[root@adminempire-bbb ~]# ip link show eth0
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether c8:a0:30:b0:b5:28 brd ff:ff:ff:ff:ff:ff

Again not a single issue on my BBB

I can paste any other tests you want me to.

No need. If you have working promiscuous mode on BBB, that’s fine. I need to solve this one.

7

Hope you can get it sorted out for yourself. If you looking for sec related stuff on the beaglebone. Check out