Check out the new USENIX Web site. next up previous
Next: Bridge Security Up: Bridge Previous: Layer-2 Filtering

Bridge as Normal Host

  A machine acting as a bridge need not have an IP address. All of the filtering provided by the bridge and ipf can be handled in the absence of an IP address, and this is actually an easier case to handle.

For the bridge machine to act as a normal host, in addition to its duties as a bridge, several changes were necessary to the path a frame takes through the kernel. As discussed above, unicast frames that are addressed to any of the member interfaces of the bridge are simply returned to ether_input(). Broadcast and multicast frames must be copied. The original frame is returned to ether_input(), and the copy is queued on the bridge.

For frames sent by the bridge, ether_output() was modified to include a special case for interfaces that are bridge members and the frame to be sent is passed to bridge_output(). This function examines the ethernet destination address of the frame. For unicast destinations, the bridge address cache is used to locate the recipient. For multicast and broadcast destinations, as well as unicast destinations not found in the address cache, the frame is forwarded to all member interfaces of the bridge.

As a result of this design, a machine acting as a bridge can also participate on the LAN as a normal host. When, for example, it sends an ARP request for a host, it will be forwarded out of every member interface. When a reply is received on any interface, the source interface and address are added to the bridge address cache as well as its ARP cache, and the frame is processed as normal. From there, all unicast frames to the remote host will use the information from the address cache for sending frames only on the correct interface.


next up previous
Next: Bridge Security Up: Bridge Previous: Layer-2 Filtering
Angelos D. Keromytis
4/21/2000