Mirroring RADIUS Traffic via a GRE Tunnel

This guide describes how to configure the BNG to copy RADIUS traffic into a GRETAP tunnel towards a separate server, for example, for analysis or for saving to a pcap file. Mirroring is performed with tc (the flower classifier and the mirred action) and does not affect the original traffic.

This guide covers a specific case: only accounting traffic (UDP port 1813) is mirrored, and only to one server. To mirror other ports or send copies to other servers, add the required filters and parameters to the script.

Example parameters

Variable	Value	Description
`IF`	ens18	BNG interface that carries RADIUS traffic
`LOCAL`	10.16.20.226	BNG address — local end of the tunnel
`REMOTE`	10.16.20.225	Address of the server that receives the mirrored traffic
`PEER`	10.16.20.231	Address of the RADIUS server whose traffic is mirrored
`TUN`	gre-mirror	GRETAP interface name

Before running the script, we recommend replacing these values with ones that match your network.

Step 1. Create the script

Create the file /usr/local/bin/bng_mirror_radius.sh:

bng_mirror_radius.sh

#!/bin/bash
# Mirror RADIUS accounting (udp/1813) between 10.16.20.226 <-> 10.16.20.231 to GRETAP towards 10.16.20.225
set -e
 
IF=ens18
LOCAL=10.16.20.226
REMOTE=10.16.20.225
PEER=10.16.20.231
TUN=gre-mirror
 
start() {
  modprobe ip_gre; modprobe cls_flower; modprobe act_mirred
 
  ip link add $TUN type gretap local $LOCAL remote $REMOTE ttl 64
  ip link set $TUN up
 
  tc qdisc add dev $IF clsact
 
  # Incoming from 231 (requests to 1813 or responses from 1813)
  tc filter add dev $IF ingress protocol ip prio 1 flower ip_proto udp src_ip $PEER dst_port 1813 \
     action mirred egress mirror dev $TUN
  tc filter add dev $IF ingress protocol ip prio 2 flower ip_proto udp src_ip $PEER src_port 1813 \
     action mirred egress mirror dev $TUN
 
  # Outgoing to 231
  tc filter add dev $IF egress protocol ip prio 1 flower ip_proto udp dst_ip $PEER dst_port 1813 \
     action mirred egress mirror dev $TUN
  tc filter add dev $IF egress protocol ip prio 2 flower ip_proto udp dst_ip $PEER src_port 1813 \
     action mirred egress mirror dev $TUN
}
 
stop() {
  tc qdisc del dev $IF clsact 2>/dev/null || true
  ip link del $TUN 2>/dev/null || true
}
 
case "$1" in
  start) start ;;
  stop)  stop ;;
  restart) stop; start ;;
  *) echo "Usage: $0 {start|stop|restart}"; exit 1 ;;
esac

Step 2. Make the script executable

chmod +x /usr/local/bin/bng_mirror_radius.sh

Step 3. Create a systemd unit

Create the file /etc/systemd/system/bng_mirror_radius.service:

bng_mirror_radius.service

[Unit]
Description=Mirror RADIUS accounting via GRETAP
After=network-online.target
Wants=network-online.target
 
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/bng_mirror_radius.sh start
ExecStop=/usr/local/bin/bng_mirror_radius.sh stop
 
[Install]
WantedBy=multi-user.target

Step 4. Start the service

Reload the systemd configuration and start the service:

systemctl daemon-reload
systemctl start bng_mirror_radius.service

To enable mirroring automatically after a reboot, add the service to startup:

systemctl enable bng_mirror_radius.service

Verification

On the BNG, make sure the tunnel is up and the filters are added:

ip -d link show gre-mirror
tc filter show dev ens18 ingress
tc filter show dev ens18 egress

On the receiving server (10.16.20.225), check that GRE traffic is arriving:

tcpdump -ni <interface> proto gre

Traffic example

Sample capture of mirrored traffic: gre_radius.pcap