Saving all incoming ethernet frames without exception on Linux?

Question

iptables

Good day, habralyudi!
On duty, I periodically dump "spurious" traffic through Wireshark (tshark, dumpcap).
Recently, I came across one tricky 800th tsiska with a relatively ancient IOS, which sent a lot of multicast traffic to the uplink (according to the upstream managed switch). Alas, I could not take a dump for analysis; and let the primary problem be solved (IOS was updated), but I want to solve the second one too - to remove all traffic (L2 / L3) without exception.
Configuration details.
There are built-in (eth0) and external USB (eth1) network adapters.
I bridge them:
# ifconfig eth0 promisc up
# ifconfig eth1 promisc up
# brctl addbr br0
# brctl addif br0 eth0
# brctl addif br0 eth1
# ifconfig br0 promisc up So it's kind of like MITM, but for noble purposes.
Through the bridge, traffic calmly goes in both directions (the GRE tunnel, in particular), but the multicast is not caught, alas.
Thinking out loud:

• for some reason I am sure that it is necessary to catch it on L2;
  
• I believe that the solution is to fine-tune the network interfaces through sysctl, but I did not pick up the right combination of parameters;
  
• in principle, it is possible to remove traffic through ulogd / Netfilter, it remains to understand where to stick the rule with "-j NFLOG".
  

Thank you in advance!

Answer 1

EMNIP for the host from the point of view of the L2 layer, the incoming multicast differs only in MAC addresses. If the interface is in promisc mode, then, in theory, the adapter should not even look at the MAC addresses of incoming packets and silently eat them all.
And in your case, the multicast is just not sniffed by tcpdump, or does it not pass through the bridge at all?

Answer 2

Forgive me if I'm wrong, but: tcpdump can't catch something?

Answer 3

port mirror on the switch does not solve the problem of getting everything? The need for a bridge is immediately eliminated.