Bridge Silently Drops LLDP Traffic Despite Ebtables Rule

I recently discovered that LLDP traffic is silently blocked/dropped via a mask in br_input.c and will not forward LLDP despite having a rule with the correct protocol value in ebtables. In ebtables, the packet count will not increment and no messages are generated in the kernel logs.

To fix the netmask value to allow LLDP, patch net/bridge/br_private.h or use my patch:

  1. diff -ur a/net/bridge/br_private.h b/net/bridge/br_private.h
  2. --- a/net/bridge/br_private.h   2014-05-02 13:05:03.466660437 -0700
  3. +++ b/net/bridge/br_private.h   2014-05-02 13:05:21.583752300 -0700
  4. @@ -34,7 +34,7 @@
  5.  /* Control of forwarding link local multicast */
  6.  #define BR_GROUPFWD_DEFAULT    0
  7.  /* Don't allow forwarding control protocols like STP and LLDP */
  8. -#define BR_GROUPFWD_RESTRICTED 0x4007u
  9. +#define BR_GROUPFWD_RESTRICTED 0x0007u
  10.  
  11.  /* Path to usermode spanning tree program */
  12.  #define BR_STP_PROG    "/sbin/bridge-stp

Now in userspace echo the following into the correct file for your bridge device

echo 16384 > /sys/class/net/[YOUR_BRIDGE_DEV]/bridge/group_fwd_mask

Blog tags: 

Add new comment

Filtered HTML

  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
By submitting this form, you accept the Mollom privacy policy.