Traffic Capture on wrong interface
-
I have configured my netgate FW in standard manner with 3 interfaces: LAN, WAN and OPT1. I am wondering why traffic such as
which is supposed to be from WAN (192.168.1.1/24) to LAN (192.168.2.1/24) appear on the OPT1 interface (192.168.3.1/24) ?
Ex. if I capture traffic on OPT1 I see:
10:51:36.731903 IP 192.168.1.68.554 > 192.168.1.15.17830: tcp 4
10:51:36.732246 IP 192.168.1.68.554 > 192.168.1.15.17830: tcp 1448
192.168.1.15 is the the interface of FW on WAN subnetStrange ?
Thanks in advance
-
@Phil-0 is this opt1 a vlan on the physical interface?
-
Only physical interface, no VLAN
-
@Phil-0 well then you sure you captured on the correct interface? Did you setup a bridge?
If you have say
eth0 - wan 192.168.1/24
eth1 - lan 192.168.2/24
eth2 - opt1 192.168.3/24And you capture traffic on eth2, you would not see any traffic from either wan or lan..
Is pfsense a physical box or a VM?
Are your physical networks actually isolated - if you have everything plugged into a non vlan capable switch all the L3 traffic would be on the same L2, etc And then yes it would be possible to see other traffic.
-
Well it is mainly my questioning...
I am wondering why such traffic with address belonging to WAN or LAN reach the OPT1 interface trough FW
I have check static route or default GW...nothing explain such behaviour. -
@Phil-0 said in Traffic Capture on wrong interface:
nothing explain such behaviour.
opt1 if a isolated network would not see any other traffic - I have multiple networks setup, isolated either physically or with vlans and have never seen such a thing.
There would be no way for the interface to see traffic, unless your not isolated like you think you are, you have setup your interfaces in a bridge, etc.
I sniff on my interfaces all the time - and have never seen traffic from different network.. If I had I would be all over figuring out why.
-
@Phil-0
So what is the source device with the IP 192.168.1.68?
Is it connected to the OPT1 interface? Possibly this IP is used twice? If so you would see arp entries in the system log telling that the IP is toggling from one to another MAC. -
@viragomann quite true - you could have a client on the wrong network with the wrong L3 trying to connect to its gateway.. But how would it arp to be able to send traffic unless your L2 were not isolated.
-
@johnpoz
That's a point. He wouldn't get any ARP response normally. -
@viragomann if I had to guess this just a mistake in what interface started capture on it defaults to wan - at least for me so it’s possible he was just sniffing traffic on wrong interface
-
I have found my problem...
The L2 switch in front of FW on OPT1 interface was configured with default management VLAN which forward traffic coming from other Subnet toward the OPT1 interface of the FW. it which 192.168.1.x adress appear on this interface and listed on the GUI of the FW
Thanks for your reply which help to ask me the good question.
Many Thanks
