Traffic leaking through Linux Bridge

[plastilin]

Hello everyone. I have the following problem. The network part in the cluster works on Linux Bridge using VLAN. The problem is that one virtual machine receives traffic that is not intended for it. It feels like the Bridge works like a regular network hub, not a network switch, and sends all traffic to all network participants. If my theory is correct, then what could be the cause of this and how can I get rid of it? I would not really like to switch to Openvswitch since everything already works.

 

[shanreich]

Hi!

Can you send me the configuration of the VM as well as the FDB of the bridge?

qm config <vmid>
bridge fdb show <bridge> > fdb.txt

Would it be possible for you to send me a tcpdump of some of this traffic from BOTH the bridge as well as the tap interface?

tcpdump -i <bridge> -w bridge.pcap
tcpdump -i <tapVM> -w tap.pcap

 

[plastilin]

.pcap files are very large to download. How can I transfer them to you?

agent: 1
balloon: 0
boot: order=virtio0
cores: 1
cpu: host
machine: q35
memory: 2048
meta: creation-qemu=8.1.5,ctime=1732618128
name: 09542
net0: virtio=BC:24:11:C3:9F7,bridge=vmbr0,tag=4048
numa: 1
ostype: l26
parent: auto-daily-241126230422
scsihw: virtio-scsi-single
smbios1: uuid=1bbd1d96-d423-4d63-a47b-eb69d5b256f5
sockets: 2
virtio0: ceph-rbd:vm-1037-disk-0,size=128M
vmgenid: 5eefda45-b987-4d3e-b58e-33bb435c024b

 

[shanreich]

.pcap files are very large to download. How can I transfer them to you?

Does compressing them possibly help? Otherwise you could upload them somewhere and send me the download link.
Can you please also indicate which traffic inside the capture is traffic that you would not expect to see on the VM?

 

[plastilin]

https://fex.net/uk/s/aerlnyp

I don't need traffic from .59.108 to .59.99 address

PVE version:

pve-manager/8.3.0/c1689ccb1065a83b (running kernel: 6.8.12-4-pve)

 

[shanreich]

How does your network configuration look like?

cat /etc/network/interfaces
ip -details l show vmbr0
ip -details l show master vmbr0

 

[shanreich]

Also: Is .59.108 on the same node or is the traffic coming from the outside?

 

[plastilin]

.59.108 - VM in the same vlan 4048 but on the same node in a cluster.

cat /etc/network/interfaces

auto lo
iface lo inet loopback


auto eno1
iface eno1 inet manual
        mtu 9000


auto eno2
iface eno2 inet manual
        mtu 9000


auto bond0
iface bond0 inet manual
        bond-slaves eno1 eno2
        bond miimon 100
        bond-mode 802.3ad
        bond-xmit-hash-policy layer3+4
        mtu 9000
        bond-lacp-rate fast


auto vmbr0
iface vmbr0 inet manual
        bridge-ports bond0
        bridge-stp off
        bridge-fd 0
        bridge-vlan-aware yes
        bridge-vids 2-4094
        mtu 9000


auto vmbr0.4040
iface vmbr0.4040 inet static
        address 10.50.253.2/24
        gateway 10.50.253.254
        mtu 9000
#MGMT


auto vmbr0.4043
iface vmbr0.4043 inet static
        address 10.50.252.2/24
        mtu 9000
#CLUSTER


auto vmbr0.4045
iface vmbr0.4045 inet static
        address 10.50.251.2/24
        mtu 9000
#CEPHCLUSTER


auto vmbr0.4053
iface vmbr0.4053 inet static
        address 10.50.250.2/24
        mtu 9000
#CEPHPUBLIC

ip -details l show vmbr0

5: vmbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc noqueue state UP mode DEFAULT group default qlen 20000
    link/ether 38:ea:a7:8e:9b:e4 brd ff:ff:ff:ff:ff:ff promiscuity 0  allmulti 0 minmtu 68 maxmtu 65535
    bridge forward_delay 0 hello_time 200 max_age 2000 ageing_time 30000 stp_state 0 priority 32768 vlan_filtering 1 vlan_protocol 802.1Q bridge_id 8000.38:ea:a7:8e:9b:e4 designated_root 8000.38:ea:a7:8e:9b:e4 root_port 0 root_path_cost 0 topology_change 0 topology_change_detected 0 hello_timer    0.00 tcn_timer    0.00 topology_change_timer    0.00 gc_timer    1.84 vlan_default_pvid 1 vlan_stats_enabled 0 vlan_stats_per_port 0 group_fwd_mask 0 group_address 01:80:c2:00:00:00 mcast_snooping 1 no_linklocal_learn 0 mcast_vlan_snooping 0 mcast_router 1 mcast_query_use_ifaddr 0 mcast_querier 0 mcast_hash_elasticity 16 mcast_hash_max 4096 mcast_last_member_count 2 mcast_startup_query_count 2 mcast_last_member_interval 100 mcast_membership_interval 26000 mcast_querier_interval 25500 mcast_query_interval 12500 mcast_query_response_interval 1000 mcast_startup_query_interval 3125 mcast_stats_enabled 0 mcast_igmp_version 2 mcast_mld_version 1 nf_call_iptables 0 nf_call_ip6tables 0 nf_call_arptables 0 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 tso_max_size 65536 tso_max_segs 65535 gro_max_size 65536

ip -details l show master vmbr0

In attached file

 

[plastilin]

Also: Is .59.108 on the same node or is the traffic coming from the outside?

Any updates?