LINUX DIGEST

INTRODUCTION

 

A bridge is a way to connect two Ethernet  segments together in a protocol independent way. Packets are forwarded based on Ethernet address, rather than IP address (like a router). Since forwarding is done at Layer 2, all protocols can go transparently through a bridge.

The Linux bridge code implements a subset of the ANSI/IEEE 802.1d standard. The original Linux bridging was first done in Linux 2.2, then rewritten by Lennert Buytenhek. The code for bridging has been integrated into 2.4 and 2.6 kernel series.

A Linux bridge is more powerful than a pure hardware bridge because it can also filter and shape traffic.

Kernel Configuration

You need to enable bridging in the kernel. Set “networking -> 802.1d Ethernet Bridging” to either yes or module

Manual Configuration

Network cards

Before you start make sure both network cards are set up and working properly. Don’t set the IP address, and don’t let the startup scripts run DHCP on the ethernet interfaces either. The IP address needs to be set after the bridge has been configured.

The command ifconfig should show both network cards, and they should be DOWN.

Module loading

In most cases, the bridge code is built as a module. If the module is configured and installed correctly, it will get automatically loaded on the first brctl command.

If your bridge-utilities have been correctly built and your kernel and bridge-module are OK, then issuing a brctl should show a small command synopsis.

 

Creating a bridge device

The command

creates a logical bridge instance with the name bridgename. You will need at least one logical instance to do any bridging at all. You can interpret the logical bridge as a container for the interfaces taking part in the bridging. Each bridging instance is represented by a new network interface. The corresponding shutdown command is:

 

 

Adding devices to a bridge

The command

adds the network device device to take part in the bridging of “bridgename.” All the devices contained in a bridge act as one big network. It is not possible to add a device to multiple bridges or bridge a bridge device, because it just wouldn’t make any sense! The bridge will take a short amount of time when a device is added to learn the Ethernet addresses on the segment before starting to forward. The corresponding command to take an interface out of the bridge is:

 

 

Showing devices in a bridge

The brctl show command gives you a summary about the overall bridge status, and the instances running as shown below:

Once a bridge is running the brctl showmacs will show information about network addresses of traffic being forwarded (and the bridge itself).

 NOTE:The aging time is the number of seconds a MAC address will be kept in the forwarding database after having received a packet from this MAC address. The entries in the forwarding database are periodically timed out to ensure they won't stay around forever. Normally there should be no need to modify this parameter, but it can be changed with (time is in seconds).

Setting ageing time to zero makes all entries permanent.

Spanning Tree Protocol

If you are running multiple or redundant bridges, then you need to enable the Spanning Tree Protocol (STP) to handle multiple hops and avoid cyclic routes.

You can see the STP parameters with:

STP tuning

There are a number of parameters related to the Spanning Tree Protocol that can be configured. The code autodetects the speed of the link and other parameters, so these usually don’t need to be changed.

Bridge priority

Each bridge has a relative priority and cost. Each interface is associated with a port (number) in the STP code. Each has a priority and a cost, that is used to decide which is the shortest path to forward a packet. The lowest cost path is always used unless the other path is down. If you have multiple bridges and interfaces then you may need to adjust the priorities to achieve optimium performance.

The bridge with the lowest priority will be elected as the root bridge. The root bridge is the “central” bridge in the spanning tree.

Path priority and cost

Each interface in a bridge could have a different speed and this value is used when deciding which link to use. Faster interfaces should have lower costs.

For multiple ports with the same cost there is also a priority

Forwarding delay

Forwarding delay time is the time spent in each of the Listening and Learning states before the Forwarding state is entered. This delay is so that when a new bridge comes onto a busy network it looks at some traffic before participating.

Hello time

Periodically, a hello packet is sent out by the Root Bridge and the Designated Bridges. Hello packets are used to communicate information about the topology throughout the entire Bridged Local Area Network.

Max age

If a another bridge in the spanning tree does not send out a hello packet for a long period of time, it is assumed to be dead. This timeout is set with:

Sample setup

The basic setup of a bridge is done like:

This will set the host up as a pure bridge, it will not have an IP address for itself, so it can not be remotely accessed (or hacked) via TCP/IP.

Optionally you can configure the virtual interface mybridge to take part in your network. It behaves like one interface (like a normal network card). Exactly that way you configure it, replacing the previous command with something like:

If you want your bridge to automatically get its IP address from the ADSL modem via DHCP (or a similar configuration), do this:

If you do this many times, you may end up with lots of dhclient processes.

Configuration with /etc/net

In    /etc/net    we  first configure two Ethernet  devices port0 and port1:

#cat  >> /etc/net/iftab
Port0   mac   00:13:46:66:01:5e
Port1  mac    00:13:46:66:01:5f

#mkdir  /etc/net/ifaces/port0

#cat  >  /etc/net/ifaces/port1/options
TYPE=eth
MODULE=via-rhine

#mkdir  /etc/net/ifaces/port1

#cat  >  /etc/net/ifaces/port1/options
TYPE=eth
MODULE=via-rhine

Then we describe the bridge:

#mkdir  /etc/net/ifaces/br0

#cat   >  /etc/net/ifaces/br0/options
TYPE=bri
HOST=’port0 port1’

#cat  >  /etc/net/ifaces/br0/brctl
Stp AUTO  on

Description: a network bridge is a forwarding technique very useful when you have to deal with virtualization and you want to give your virtual machines direct access to your real network, without using NAT.

In this example, I’m going to use a bridge (br0) to access a wired network interface (eth1). I use eth1 for the bridge instead of eth0 because I prefer to use the first network interface to access the machine using SSH and fix any problems that could appear while configuring the bridge.

INSTALLATION

This improves the bridge’s performance. I recommend to use packet filtering in the computers which connect through the bridge, but not in the bridge itself