I just did a quick search for “CESG layer 2 encryption” (CESG are a british government agency who specialise in assurance for computer systems), on Google, and found a few options on their list, there’s at least one that’ll do 1Gbit, and a few that’ll do up to 10Gbit. It’d probably (almost definitely) be overkill, … Read more
VLAN tag is stripped from skb in recent kernels. Try something like this to do a meta match in skb: tc filter add dev internal protocol all parent 1:0 prio 100 basic match ‘meta(vlan mask 0xfff eq 0x0ed8)’ flowid 1:300
We’re doing this with Server 2003 where I am. The key is our central layer 3 device (in our case an old 3Com 4900 SX). It has what 3Com calls a “virtual interface” for each vlan. When dhcp requests arrive at the device from the outside it forwards them using same vlan interface they arrived … Read more
I remembered that you can examine the packet bytes directly. So looking directly into the ethernet header works: tcpdump -vv -i eth1 ‘( vlan and ( ether[14:2] & 0xfff == 1000 or ether[14:2] & 0xfff == 501 ) ) and ( ip host 10.1.1.98 or ip host 10.1.1.99 )’ Don’t forget the :2, this is … Read more
VLANs and subnets solve different problems. VLANs work at Layer 2, thereby altering broadcast domains (for instance). Whereas subnets are Layer 3 in the current context One suggestion would be to actually implement both Have, for instance, VLAN 10 – 15 for your different device types (Dev, Test, Production, Users, etc) VLAN 10, you may … Read more
In addition to the info on Why do people tell me not to use VLANs for security? here are some more specific & general bits to consider: General Thoughts on Security The most secure system is one where each subnet’s hosts are connected to a switch having exactly the number of ports that will be … Read more
You can’t see VLAN tag from tcpdump -i eth0 output on i686/x86_64 architecture because of VLAN acceleration. the VLAN layer will be filtered by kernel so it always looks untagged. Please refer to Bug 498981 – tcpdump cannot deal with 802.1q vlan tag According to your case, you can get VLAN tags via: tcpdump -i … Read more
I fixed the problem today by removing the vlan tag for the phone vlan on the port connecting to our dhcp server. It’s very strange to me that this worked, as other systems that use a similar scheme (aka: Wifi SSIDs using 802.1q) require the tag or clients cannot get addresses. It worked, so I … Read more
Under FreeBSD (pfSense is based on FreeBSD and has nothing to do with Linux) you can create multiple wlan interfaces based on the physical interface, then connect them to various APs. For instance, if you have an Atheros card in your computer (and it isn’t renamed): ifconfig wlan0 create wlandev ath0 ifconfig wlan bssid NetworkA … Read more
I believe this is merely an IP address for the VLAN-aware device that happens to be on that VLAN. You need it if the device in question is going to be doing routing involving that VLAN, or if you expect to manage the device (ie through SNMP) on that VLAN. (after your update) I see … Read more