Mirroring RADIUS Traffic via a GRE Tunnel
This guide describes how to configure the BNG to copy RADIUS traffic into a GRETAP tunnel towards a separate server, for example, for analysis or for saving to a pcap file. Mirroring is performed with tc (the flower classifier and the mirred action) and does not affect the original traffic.
This guide covers a specific case: only accounting traffic (UDP port 1813) is mirrored, and only to one server. To mirror other ports or send copies to other servers, add the required filters and parameters to the script.
Example parameters
| Variable | Value | Description |
|---|---|---|
IF | ens18 | BNG interface that carries RADIUS traffic |
LOCAL | 10.16.20.226 | BNG address — local end of the tunnel |
REMOTE | 10.16.20.225 | Address of the server that receives the mirrored traffic |
PEER | 10.16.20.231 | Address of the RADIUS server whose traffic is mirrored |
TUN | gre-mirror | GRETAP interface name |
Before running the script, we recommend replacing these values with ones that match your network.
Step 1. Create the script
Create the file /usr/local/bin/bng_mirror_radius.sh:
- bng_mirror_radius.sh
#!/bin/bash # Mirror RADIUS accounting (udp/1813) between 10.16.20.226 <-> 10.16.20.231 to GRETAP towards 10.16.20.225 set -e IF=ens18 LOCAL=10.16.20.226 REMOTE=10.16.20.225 PEER=10.16.20.231 TUN=gre-mirror start() { modprobe ip_gre; modprobe cls_flower; modprobe act_mirred ip link add $TUN type gretap local $LOCAL remote $REMOTE ttl 64 ip link set $TUN up tc qdisc add dev $IF clsact # Incoming from 231 (requests to 1813 or responses from 1813) tc filter add dev $IF ingress protocol ip prio 1 flower ip_proto udp src_ip $PEER dst_port 1813 \ action mirred egress mirror dev $TUN tc filter add dev $IF ingress protocol ip prio 2 flower ip_proto udp src_ip $PEER src_port 1813 \ action mirred egress mirror dev $TUN # Outgoing to 231 tc filter add dev $IF egress protocol ip prio 1 flower ip_proto udp dst_ip $PEER dst_port 1813 \ action mirred egress mirror dev $TUN tc filter add dev $IF egress protocol ip prio 2 flower ip_proto udp dst_ip $PEER src_port 1813 \ action mirred egress mirror dev $TUN } stop() { tc qdisc del dev $IF clsact 2>/dev/null || true ip link del $TUN 2>/dev/null || true } case "$1" in start) start ;; stop) stop ;; restart) stop; start ;; *) echo "Usage: $0 {start|stop|restart}"; exit 1 ;; esac
Step 2. Make the script executable
chmod +x /usr/local/bin/bng_mirror_radius.sh
Step 3. Create a systemd unit
Create the file /etc/systemd/system/bng_mirror_radius.service:
- bng_mirror_radius.service
[Unit] Description=Mirror RADIUS accounting via GRETAP After=network-online.target Wants=network-online.target [Service] Type=oneshot RemainAfterExit=yes ExecStart=/usr/local/bin/bng_mirror_radius.sh start ExecStop=/usr/local/bin/bng_mirror_radius.sh stop [Install] WantedBy=multi-user.target
Step 4. Start the service
Reload the systemd configuration and start the service:
systemctl daemon-reload systemctl start bng_mirror_radius.service
To enable mirroring automatically after a reboot, add the service to startup:
systemctl enable bng_mirror_radius.service
Verification
On the BNG, make sure the tunnel is up and the filters are added:
ip -d link show gre-mirror tc filter show dev ens18 ingress tc filter show dev ens18 egress
On the receiving server (10.16.20.225), check that GRE traffic is arriving:
tcpdump -ni <interface> proto gre
Traffic example
Sample capture of mirrored traffic: gre_radius.pcap
Was this information helpful?
