TC-MIRRED(8)

🦋 TC-MIRRED(8) 🦋

okay bestie, this is the tc-mirred page, aka the mirror/redirect action in tc(8) 💖 It's the thing that lets you copy or steal packets as they come in, and it's lowkey iconic 💅

✨ NAME ✨

mirred - mirror/redirect action 🧚

💜 SYNOPSIS 💜

tc ... action mirred DIRECTION ACTION [ index INDEX ] TARGET

DIRECTION := { ingress | egress }

TARGET := { DEV | BLOCK }

DEV := dev DEVICENAME

BLOCK := blockid BLOCKID

ACTION := { mirror | redirect }

🌸 DESCRIPTION 🌸

okay so the mirred action lets you do packet mirroring (copying) or redirecting (stealing) whatever packet it receives 🔥 Mirroring is what people call Switch Port Analyzer (SPAN), and it's super popular for analyzing and/or debugging flows 🙈

when you mirror to a tc block, the packet gets copied to every port in the block EXCEPT the port it came in on (only if that port is actually part of the tc block) ✨ Redirecting is basically the same vibe, except it mirrors to the first N - 1 ports in the block and then redirects to the last one 💀 The port the packet arrived on is never mirrored or redirected to, so don't even try 🙅‍♀️

🎀 OPTIONS 🎀

• ingress / egress — pick the direction the packet shows up in on the destination interface 🦋
• mirror / redirect — decide whether the packet gets copied (mirror) or moved (redirect) to the destination interface or block 💅
• index INDEX — give this action its own unique ID instead of letting the kernel pick one for you 🧚 INDEX is a 32bit unsigned integer that has to be greater than zero
• dev DEVICENAME — the network interface you want to redirect or mirror to 🌈
• blockid BLOCKID — the tc block you want to redirect or mirror to ⭐

💖 EXAMPLES 💖

okay here are the examples, bestie, they're giving practical energy 🫶

Limit ingress bandwidth on eth0 to 1mbit/s, and redirect the exceeding traffic to lo for debugging purposes 🍓

# tc qdisc add dev eth0 handle ffff: clsact
# tc filter add dev eth0 ingress u32 \
     match u32 0 0 \
     action police rate 1mbit burst 100k conform-exceed pipe \
     action mirred egress redirect dev lo

Mirror all incoming ICMP packets on eth0 to a dummy interface so you can examine them with e.g. tcpdump 👀

# ip link add dummy0 type dummy
# ip link set dummy0 up
# tc qdisc add dev eth0 handle ffff: clsact
# tc filter add dev eth0 ingress protocol ip \
     u32 match ip protocol 1 0xff \
     action mirred egress mirror dev dummy0

Using an ifb interface, you can send ingress traffic through an instance of sfq 🧚‍♀️✨

# modprobe ifb
# ip link set ifb0 up
# tc qdisc add dev ifb0 root sfq
# tc qdisc add dev eth0 handle ffff: clsact
# tc filter add dev eth0 ingress u32 \
     match u32 0 0 \
     action mirred egress redirect dev ifb0

😭 LIMITATIONS 😭

the kernel caps nesting at four levels so nesting loops can't happen 🔒

⚠️ Do not redirect from one IFB device to another. IFB is a very specialized case of packet redirecting device, and redirecting from ifbX->ifbY will cause ALL packets to be dropped. literally the worst, don't do it 💀

🌈 SEE ALSO 🌈

tc(8), tc-u32(8) 🦋

that's a wrap, bestie! 💜 Source: iproute2, version dated 11 Jan 2015 (Linux) 🫶✨ now go mirror something iconic 👑💅