MITM attacks between two LAN devices

Software SW help
,
1

Hi,

I would like to be able to realize MitM attacks between two LAN devices (not WAN/LAN) from the Omnia, using for example mitmproxy.
This post is very similar to a previous one I made here, but this time I actually want to intercept the traffic on the Omnia.

This is the situation:

  1. The WAN interface is connected and configured to provide Internet access to the LAN devices
  2. The two LAN devices are connected to two of the LAN ports

So far, by simply running tcpdump on the Omnia, the only packets I am able to see are the one that are adressed to, or coming from the Omnia itself and not any direct communication between the two lan devices.
After some research, this seems to make sense, as from what I have seen in the documentation, every lan port is connected to the switch-chip and not directly to a ethx (CPU) interface. I suppose the packets are being switched before getting to any ethx (CPU) interface.

I figured one way to intercept the packets is to link one LAN port to the eth0 CPU interface and link the other LAN port to the eth1 CPU interface. This way the SoC would have to do the routing and thus, would have access to the packets.
However, as mentioned in this issue (Omnia, kernel 5.15: All switch ports use the same CPU port (#363) · Issues · Turris / Turris OS / Turris Build · GitLab), it seems that multi-CPU DSA is not implemented in the 5.15 kernel used in Turris OS 7.

So far, I tried to install the latest snapshot of OpenWRT which is using a 6.6 kernel (with multi-CPU DSA) but it seems that the switch driver (mv88e6xxx) still does not implement changing the CPU interface associated with the switch port, as when trying to link the lan3 port to the eth0 CPU interface I get the following :

root@OpenWRT:~# ip link set lan3 type dsa conduit eth0
Error: dsa_core: Driver does not support changing DSA master.

So my question is: Does someone knows a way to intercept direct communication of the two LAN devices from the Omnia? Either by using the eth0 and eth1 interfaces or any other way?

Thanks in advance.

2

What about VLANs? Can’t you configure the comms so that there is no direct connection and the Omnia has to actively route between two VLANs?

3

Could this help you out in your situation?
DSA config

4

This is actually the link I used to try to affect another CPU port to a user port, but the switch driver doesn’t seem to support it.

5

I don’t know much about VLANs but, following this OpenWRT DSA tutorial I was able to setup two distinct IP networks based on VLANs.
After testing, it seems that this indeed make the Omnia actively route packets and I was able to control the communication, thanks!

6

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.