Blocking STP Traffic

Question

I am using Xen virtualization with a bridged mode netwrk. I noticed that there is a lot of spanning tree (as understand) traffic coming from a network. Such as:

STP 802.1d, Config, Flags [none], bridge-id ......
STP 802.1s, Rapid STP, CIST Flags [Proposal, Learn, Forward, Agreement]

I do not want VPS to receive these messages - is it possible to filter it? I guess I need to do something like:

ebtables -A INPUT -d BGA  -j DROP

But that did not help. What am I doing wrong?

What kind of switch is your system connected to? A managed switch has the capability to put ports in an STP mode that quiets this down a bit. — SpacemanSpiff, Sep 20 '13 at 15:00
I have no idea. And i have no control over the switch as it's owned by a DC and they are not going to modify anything. — Radium, Sep 20 '13 at 15:09

score 1 · Answer 1 · answered Sep 20 '13 at 14:40

1

STP (Spanning tree) is a protocol to prevent network loops. Blocking STP in the firewall has no use. You could change your network so the STP and your VM are on a different VLAN. I think that would be the proper solution for this.

answered Sep 20 '13 at 14:40

Jeroen

1,339
7
16

Could be a solution but i do not think VLAN over OpenVPN is a good idea in my case. – Radium Sep 20 '13 at 20:42

score 0 · Answer 2 · answered Feb 07 '22 at 17:58

Maybe something like this would help...

cli# ebtables -I FIREWALL -i eth0 -d 01:00:0C:CC:CC:CC -j DROP 
cli# ebtables -I FIREWALL -i eth0 -d 01:00:0C:CC:CC:CD -j DROP 
cli# ebtables -I FIREWALL -i eth0 -d 01:80:C2:00:00:00 -j DROP 
cli# ebtables -I FIREWALL -i eth0 -d 01:80:C2:00:00:08 -j DROP 
cli# ebtables -I FIREWALL -i eth0 -d 01:80:C2:00:00:01 -j DROP

score 0 · Answer 3 · answered Sep 20 '13 at 18:45

0

On the host node, you need to match in the FORWARD chain instead of INPUT chain.

ebtables -A FORWARD -d BGA -o vif+ -j DROP

and just to be sure the guests aren't spoofing STP out

ebtables -A FORWARD -d BGA -i vif+ -j DROP

Another option is to move to a routed instead of bridged network configuration.

answered Sep 20 '13 at 18:45

Andrew Domaszek

5,103
1
14
26

Still see "STP 802.1d, Config, Flags" messages ... – Radium Sep 20 '13 at 19:27
Well then it started to work, use the --stp-* matches to also block those. – Andrew Domaszek Sep 20 '13 at 19:45
Sorry but i can't figure out how to do that. I thought "Config" is a stp-type, so did "-d BGA -o vif+ --stp-type config -j DROP" but didn't help. – Radium Sep 20 '13 at 19:54

score 0 · Answer 4 · answered Jun 26 '19 at 11:11

I know this is a very old question, but one I needed to sort out myself today. After a LOT of trial and error, I found this command to work:

sudo ebtables -A FORWARD -p LENGTH --802_3-type 10b -j DROP

To be sure you don't block anything you don't want to, please add -o {interface name}, such as:

sudo ebtables -A FORWARD -o l2tpeth0 -p LENGTH --802_3-type 10b -j DROP

We're using Cisco equipment, I don't know if the same applies to other vendors.

Blocking STP Traffic

4 Answers4