Linux "ebtables" Command Line Options and Examples

Ethernet bridge frame table administration

ebtables is an application program used to set up and maintain the tables of rules (inside the Linux kernel) that inspect Ethernet frames. It is analogous to the iptables application, but less complicated, due to the fact that the Ethernet protocol is much sim‐ pler than the IP protocol. CHAINS There are three ebtables tables with built-in chains in the Linux kernel.

Usage:

ebtables [-t table ] -[ACDI] chain rule specification [match extensions] [watcher extensions] target ebtables [-t table ] -P chain ACCEPT | DROP | RETURN ebtables [-t table ] -F [chain] ebtables [-t table ] -Z [chain] ebtables [-t table ] -L [-Z] [chain] [ [--Ln] | [--Lx] ] [--Lc] [--Lmac2] ebtables [-t table ] -N chain [-P ACCEPT | DROP | RETURN] ebtables [-t table ] -X [chain] ebtables [-t table ] -E old-chain-name new-chain-name ebtables [-t table ] --init-table ebtables [-t table ] [--atomic-file file] --atomic-commit ebtables [-t table ] [--atomic-file file] --atomic-init ebtables [-t table ] [--atomic-file file] --atomic-save

Related Commands

Command Line Options:

-t

filter is the default table and contains three built-in chains: INPUT (for frames destined for the bridge itself, on the levelof the MAC destination address), OUTPUT (for locally-generated or (b)routed frames) and FORWARD (for frames being forwarded bythe bridge).nat is mostly used to change the mac addresses and contains three built-in chains: PREROUTING (for altering frames as soon asthey come in), OUTPUT (for altering locally generated or (b)routed frames before they are bridged) and POSTROUTING (for alter‐ing frames as they are about to go out). A small note on the naming of chains PREROUTING and POSTROUTING: it would be moreaccurate to call them PREFORWARDING and POSTFORWARDING, but for all those who come from the iptables world to ebtables it iseasier to have the same names. Note that you can change the name (-E) if you don't like the default.broute is used to make a brouter, it has one built-in chain: BROUTING. The targets DROP and ACCEPT have a special meaning inthe broute table (these names are used instead of more descriptive names to keep the implementation generic). DROP actuallymeans the frame has to be routed, while ACCEPT means the frame has to be bridged. The BROUTING chain is traversed very early.However, it is only traversed by frames entering on a bridge port that is in forwarding state. Normally those frames would bebridged, but you can decide otherwise here. The redirect target is very handy here.EBTABLES COMMAND LINE ARGUMENTSAfter the initial ebtables '-t table' command line argument, the remaining arguments can be divided into several groups. Thesegroups are commands, miscellaneous commands, rule specifications, match extensions, watcher extensions and target extensions.COMMANDSThe ebtables command arguments specify the actions to perform on the table defined with the -t argument. If you do not use the -targument to name a table, the commands apply to the default filter table. Only one command may be used on the command line at atime, except when the commands -L and -Z are combined, the commands -N and -P are combined, or when --atomic-file is used.


                            ebtables -t ...

-A

Append a rule to the end of the selected chain.


                            ebtables -A ...

-D

Delete the specified rule or rules from the selected chain. There are two ways to use this command. The first is by specifyingan interval of rule numbers to delete (directly after -D). Syntax: start_nr[:end_nr] (use -L --Ln to list the rules withtheir rule number). When end_nr is omitted, all rules starting from start_nr are deleted. Using negative numbers is allowed,for more details about using negative numbers, see the -I command. The second usage is by specifying the complete rule as itwould have been specified when it was added. Only the first encountered rule that is the same as this specified rule, in otherwords the matching rule with the lowest (positive) rule number, is deleted.


                            ebtables -D ...

-C

Change the counters of the specified rule or rules from the selected chain. There are two ways to use this command. The firstis by specifying an interval of rule numbers to do the changes on (directly after -C). Syntax: start_nr[:end_nr] (use -L --Lnto list the rules with their rule number). The details are the same as for the -D command. The second usage is by specifyingthe complete rule as it would have been specified when it was added. Only the counters of the first encountered rule that isthe same as this specified rule, in other words the matching rule with the lowest (positive) rule number, are changed. In thefirst usage, the counters are specified directly after the interval specification, in the second usage directly after -C.First the packet counter is specified, then the byte counter. If the specified counters start with a '+', the counter valuesare added to the respective current counter values. If the specified counters start with a '-', the counter values aredecreased from the respective current counter values. No bounds checking is done. If the counters don't start with '+' or '-',the current counters are changed to the specified counters.


                            ebtables -C ...

-I

Insert the specified rule into the selected chain at the specified rule number. If the rule number is not specified, the ruleis added at the head of the chain. If the current number of rules equals N, then the specified number can be between -N andN+1. For a positive number i, it holds that i and i-N-1 specify the same place in the chain where the rule should beinserted. The rule number 0 specifies the place past the last rule in the chain and using this number is therefore equivalentto using the -A command. Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted in achain.


                            ebtables -I ...

-P

Set the policy for the chain to the given target. The policy can be ACCEPT, DROP or RETURN.


                            ebtables -P ...

-F

Flush the selected chain. If no chain is selected, then every chain will be flushed. Flushing a chain does not change the pol‐icy of the chain, however.


                            ebtables -F ...

-Z

Set the counters of the selected chain to zero. If no chain is selected, all the counters are set to zero. The -Z command canbe used in conjunction with the -L command. When both the -Z and -L commands are used together in this way, the rule countersare printed on the screen before they are set to zero.


                            ebtables -Z ...

-L

List all rules in the selected chain. If no chain is selected, all chains are listed.The following options change the output of the -L command.


                            ebtables -L ...

--Ln

Places the rule number in front of every rule. This option is incompatible with the --Lx option.


                            ebtables --Ln ...

--Lc

Shows the counters at the end of each rule displayed by the -L command. Both a frame counter (pcnt) and a byte counter (bcnt)are displayed. The frame counter shows how many frames have matched the specific rule, the byte counter shows the sum of theframe sizes of these matching frames. Using this option in combination with the --Lx option causes the counters to be writtenout in the '-c <pcnt> <bcnt>' option format.


                            ebtables --Lc ...

--Lx

Changes the output so that it produces a set of ebtables commands that construct the contents of the chain, when specified.If no chain is specified, ebtables commands to construct the contents of the table are given, including commands for creatingthe user-defined chains (if any). You can use this set of commands in an ebtables boot or reload script. For example theoutput could be used at system startup. The --Lx option is incompatible with the --Ln listing option. Using the --Lx optiontogether with the --Lc option will cause the counters to be written out in the '-c <pcnt> <bcnt>' option format.


                            ebtables --Lx ...

--Lmac2

Shows all MAC addresses with the same length, adding leading zeroes if necessary. The default representation omits leadingzeroes in the addresses.


                            ebtables --Lmac2 ...

-N

Create a new user-defined chain with the given name. The number of user-defined chains is limited only by the number of possi‐ble chain names. A user-defined chain name has a maximum length of 31 characters. The standard policy of the user-definedchain is ACCEPT. The policy of the new chain can be initialized to a different standard target by using the -P commandtogether with the -N command. In this case, the chain name does not have to be specified for the -P command.


                            ebtables -N ...

-X

Delete the specified user-defined chain. There must be no remaining references (jumps) to the specified chain, otherwise ebta‐bles will refuse to delete it. If no chain is specified, all user-defined chains that aren't referenced will be removed.


                            ebtables -X ...

-E

Rename the specified chain to a new name. Besides renaming a user-defined chain, you can rename a standard chain to a namethat suits your taste. For example, if you like PREFORWARDING more than PREROUTING, then you can use the -E command to renamethe PREROUTING chain. If you do rename one of the standard ebtables chain names, please be sure to mention this fact shouldyou post a question on the ebtables mailing lists. It would be wise to use the standard name in your post. Renaming a stan‐dard ebtables chain in this fashion has no effect on the structure or functioning of the ebtables kernel table.


                            ebtables -E ...

--init-table

Replace the current table data by the initial table data.


                            ebtables --init-table ...

--atomic-init

Copy the kernel's initial data of the table to the specified file. This can be used as the first action, after which rules areadded to the file. The file can be specified using the --atomic-file command or through the EBTABLES_ATOMIC_FILE environmentvariable.


                            ebtables --atomic-init ...

--atomic-save

Copy the kernel's current data of the table to the specified file. This can be used as the first action, after which rules areadded to the file. The file can be specified using the --atomic-file command or through the EBTABLES_ATOMIC_FILE environmentvariable.


                            ebtables --atomic-save ...

--atomic-commit

Replace the kernel table data with the data contained in the specified file. This is a useful command that allows you to loadall your rules of a certain table into the kernel at once, saving the kernel a lot of precious time and allowing atomicupdates of the tables. The file which contains the table data is constructed by using either the --atomic-init or the


                            ebtables --atomic-commit ...

-V

Show the version of the ebtables userspace program.


                            ebtables -V ...

-h

Give a brief description of the command syntax. Here you can also specify names of extensions and ebtables will try to writehelp about those extensions. E.g. ebtables -h snat log ip arp. Specify list_extensions to list all extensions supported bythe userspace utility.


                            ebtables -h ...

-j

The target of the rule. This is one of the following values: ACCEPT, DROP, CONTINUE, RETURN, a target extension (see TARGETEXTENSIONS) or a user-defined chain name.


                            ebtables -j ...

--atomic-file

Let the command operate on the specified file. The data of the table to operate on will be extracted from the file and theresult of the operation will be saved back into the file. If specified, this option should come before the command specifica‐tion. An alternative that should be preferred, is setting the EBTABLES_ATOMIC_FILE environment variable.


                            ebtables --atomic-file ...

-M

When talking to the kernel, use this program to try to automatically load missing kernel modules.


                            ebtables -M ...

--concurrent

Use a file lock to support concurrent scripts updating the ebtables kernel tables.RULE SPECIFICATIONSThe following command line arguments make up a rule specification (as used in the add and delete commands). A "!" option before thespecification inverts the test for that specification. Apart from these standard rule specifications there are some other commandline arguments of interest. See both the MATCH EXTENSIONS and the WATCHER EXTENSIONS below.


                            ebtables --concurrent ...

-p

The protocol that was responsible for creating the frame. This can be a hexadecimal number, above 0x0600, a name (e.g. ARP )or LENGTH. The protocol field of the Ethernet frame can be used to denote the length of the header (802.2/802.3 networks).When the value of that field is below or equals 0x0600, the value equals the size of the header and shouldn't be used as aprotocol number. Instead, all frames where the protocol field is used as the length field are assumed to be of the same 'pro‐tocol'. The protocol name used in ebtables for these frames is LENGTH.The file /etc/ethertypes can be used to show readable characters instead of hexadecimal numbers for the protocols. For exam‐ple, 0x0800 will be represented by IPV4. The use of this file is not case sensitive. See that file for more information. Theflag --proto is an alias for this option.


                            ebtables -p ...

-i

The interface (bridge port) via which a frame is received (this option is useful in the INPUT, FORWARD, PREROUTING and BROUT‐ING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+') willmatch. The flag --in-if is an alias for this option.


                            ebtables -i ...

--logical-in

The (logical) bridge interface via which a frame is received (this option is useful in the INPUT, FORWARD, PREROUTING andBROUTING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+')will match.


                            ebtables --logical-in ...

-o

The interface (bridge port) via which a frame is going to be sent (this option is useful in the OUTPUT, FORWARD and POSTROUT‐ING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding '+') willmatch. The flag --out-if is an alias for this option.


                            ebtables -o ...

--logical-out

The (logical) bridge interface via which a frame is going to be sent (this option is useful in the OUTPUT, FORWARD andPOSTROUTING chains). If the interface name ends with '+', then any interface name that begins with this name (disregarding'+') will match.


                            ebtables --logical-out ...

-s

The source MAC address. Both mask and address are written as 6 hexadecimal numbers separated by colons. Alternatively one canspecify Unicast, Multicast, Broadcast or BGA (Bridge Group Address):Unicast=00:00:00:00:00:00/01:00:00:00:00:00, Multicast=01:00:00:00:00:00/01:00:00:00:00:00, Broad‐cast=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or BGA=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff. Note that a broadcast address will alsomatch the multicast specification. The flag --src is an alias for this option.


                            ebtables -s ...

-d

The destination MAC address. See -s (above) for more details on MAC addresses. The flag --dst is an alias for this option.


                            ebtables -d ...

-c

If used with -A or -I, then the packet and byte counters of the new rule will be set to pcnt, resp. bcnt. If used with the -Cor -D commands, only rules with a packet and byte count equal to pcnt, resp. bcnt will match.MATCH EXTENSIONSEbtables extensions are dynamically loaded into the userspace tool, there is therefore no need to explicitly load them with a -moption like is done in iptables. These extensions deal with functionality supported by kernel modules supplemental to the core ebta‐bles code.802_3Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as LENGTH (see the option -p above).


                            ebtables -c ...

--802_3-sap

DSAP and SSAP are two one byte 802.3 fields. The bytes are always equal, so only one byte (hexadecimal) is needed as an argu‐ment.


                            ebtables --802_3-sap ...

--802_3-type

If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must be consulted to determine the payload protocol. Thisis a two byte (hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are checked for type.amongMatch a MAC address or MAC/IP address pair versus a list of MAC addresses and MAC/IP address pairs. A list entry has the followingformat: xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,]. Multiple list entries are separated by a comma, specifying an IP address corresponding tothe MAC address is optional. Multiple MAC/IP address pairs with the same MAC address but different IP address (and vice versa) can bespecified. If the MAC address doesn't match any entry from the list, the frame doesn't match the rule (unless "!" was used).


                            ebtables --802_3-type ...

--among-dst

Compare the MAC destination to the given list. If the Ethernet frame has type IPv4 or ARP, then comparison with MAC/IP desti‐nation address pairs from the list is possible.


                            ebtables --among-dst ...

--among-src

Compare the MAC source to the given list. If the Ethernet frame has type IPv4 or ARP, then comparison with MAC/IP sourceaddress pairs from the list is possible.


                            ebtables --among-src ...

--among-dst-file

Same as --among-dst but the list is read in from the specified file.


                            ebtables --among-dst-file ...

--among-src-file

Same as --among-src but the list is read in from the specified file.arpSpecify (R)ARP fields. The protocol must be specified as ARP or RARP.


                            ebtables --among-src-file ...

--arp-opcode

The (R)ARP opcode (decimal or a string, for more details see ebtables -h arp).


                            ebtables --arp-opcode ...

--arp-htype

The hardware type, this can be a decimal or the string Ethernet (which sets type to 1). Most (R)ARP packets have Eternet ashardware type.


                            ebtables --arp-htype ...

--arp-ptype

The protocol type for which the (r)arp is used (hexadecimal or the string IPv4, denoting 0x0800). Most (R)ARP packets haveprotocol type IPv4.


                            ebtables --arp-ptype ...

--arp-ip-src

The (R)ARP IP source address specification.


                            ebtables --arp-ip-src ...

--arp-ip-dst

The (R)ARP IP destination address specification.


                            ebtables --arp-ip-dst ...

--arp-mac-src

The (R)ARP MAC source address specification.


                            ebtables --arp-mac-src ...

--arp-mac-dst

The (R)ARP MAC destination address specification.[!] --arp-gratuitousChecks for ARP gratuitous packets: checks equality of IPv4 source address and IPv4 destination address inside the ARP header.ipSpecify IPv4 fields. The protocol must be specified as IPv4.


                            ebtables --arp-mac-dst ...

--ip-source

The source IP address. The flag --ip-src is an alias for this option.


                            ebtables --ip-source ...

--ip-destination

The destination IP address. The flag --ip-dst is an alias for this option.


                            ebtables --ip-destination ...

--ip-tos

The IP type of service, in hexadecimal numbers. IPv4.


                            ebtables --ip-tos ...

--ip-protocol

The IP protocol. The flag --ip-proto is an alias for this option.


                            ebtables --ip-protocol ...

--ip-source-port

The source port or port range for the IP protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip-protocol option mustbe specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is specified,port1:65535 is used. The flag --ip-sport is an alias for this option.


                            ebtables --ip-source-port ...

--ip-destination-port

The destination port or port range for ip protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip-protocol option mustbe specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is specified,port1:65535 is used. The flag --ip-dport is an alias for this option.ip6Specify IPv6 fields. The protocol must be specified as IPv6.


                            ebtables --ip-destination-port ...

--ip6-source

The source IPv6 address. The flag --ip6-src is an alias for this option.


                            ebtables --ip6-source ...

--ip6-destination

The destination IPv6 address. The flag --ip6-dst is an alias for this option.


                            ebtables --ip6-destination ...

--ip6-tclass

The IPv6 traffic class, in hexadecimal numbers.


                            ebtables --ip6-tclass ...

--ip6-protocol

The IP protocol. The flag --ip6-proto is an alias for this option.


                            ebtables --ip6-protocol ...

--ip6-source-port

The source port or port range for the IPv6 protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip6-protocol optionmust be specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is speci‐fied, port1:65535 is used. The flag --ip6-sport is an alias for this option.


                            ebtables --ip6-source-port ...

--ip6-destination-port

The destination port or port range for IPv6 protocols 6 (TCP), 17 (UDP), 33 (DCCP) or 132 (SCTP). The --ip6-protocol optionmust be specified as TCP, UDP, DCCP or SCTP. If port1 is omitted, 0:port2 is used; if port2 is omitted but a colon is speci‐fied, port1:65535 is used. The flag --ip6-dport is an alias for this option.


                            ebtables --ip6-destination-port ...

--ip6-icmp-type

Specify ipv6-icmp type and code to match. Ranges for both type and code are supported. Type and code are separated by aslash. Valid numbers for type and range are 0 to 255. To match a single type including all valid codes, symbolic names can beused instead of numbers. The list of known type names is shown by the commandebtables --help ip6This option is only valid for --ip6-prococol ipv6-icmp.limitThis module matches at a limited rate using a token bucket filter. A rule using this extension will match until this limit isreached. It can be used with the --log watcher to give limited logging, for example. Its use is the same as the limit match of ipta‐bles.


                            ebtables --ip6-icmp-type ...

--limit

Maximum average matching rate: specified as a number, with an optional /second, /minute, /hour, or /day suffix; the default is3/hour.


                            ebtables --limit ...

--limit-burst

Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is notreached, up to this number; the default is 5.mark_m


                            ebtables --limit-burst ...

--mark

Matches frames with the given unsigned mark value. If a value and mask are specified, the logical AND of the mark value of theframe and the user-specified mask is taken before comparing it with the user-specified mark value. When only a mark value isspecified, the packet only matches when the mark value of the frame equals the user-specified mark value. If only a mask isspecified, the logical AND of the mark value of the frame and the user-specified mask is taken and the frame matches when theresult of this logical AND is non-zero. Only specifying a mask is useful to match multiple mark values.pkttype


                            ebtables --mark ...

--pkttype-type

Matches on the Ethernet "class" of the frame, which is determined by the generic networking code. Possible values: broadcast(MAC destination is the broadcast address), multicast (MAC destination is a multicast address), host (MAC destination is thereceiving network device), or otherhost (none of the above).stpSpecify stp BPDU (bridge protocol data unit) fields. The destination address (-d) must be specified as the bridge group address(BGA). For all options for which a range of values can be specified, it holds that if the lower bound is omitted (but the colon isnot), then the lowest possible lower bound for that option is used, while if the upper bound is omitted (but the colon again is not),the highest possible upper bound for that option is used.


                            ebtables --pkttype-type ...

--stp-type

The BPDU type (0-255), recognized non-numerical types are config, denoting a configuration BPDU (=0), and tcn, denothing atopology change notification BPDU (=128).


                            ebtables --stp-type ...

--stp-flags

The BPDU flag (0-255), recognized non-numerical flags are topology-change, denoting the topology change flag (=1), and topol‐ogy-change-ack, denoting the topology change acknowledgement flag (=128).


                            ebtables --stp-flags ...

--stp-root-prio

The root priority (0-65535) range.


                            ebtables --stp-root-prio ...

--stp-root-addr

The root mac address, see the option -s for more details.


                            ebtables --stp-root-addr ...

--stp-root-cost

The root path cost (0-4294967295) range.


                            ebtables --stp-root-cost ...

--stp-sender-prio

The BPDU's sender priority (0-65535) range.


                            ebtables --stp-sender-prio ...

--stp-sender-addr

The BPDU's sender mac address, see the option -s for more details.


                            ebtables --stp-sender-addr ...

--stp-port

The port identifier (0-65535) range.


                            ebtables --stp-port ...

--stp-msg-age

The message age timer (0-65535) range.


                            ebtables --stp-msg-age ...

--stp-max-age

The max age timer (0-65535) range.


                            ebtables --stp-max-age ...

--stp-hello-time

The hello time timer (0-65535) range.


                            ebtables --stp-hello-time ...

--stp-forward-delay

The forward delay timer (0-65535) range.vlanSpecify 802.1Q Tag Control Information fields. The protocol must be specified as 802_1Q (0x8100).


                            ebtables --stp-forward-delay ...

--vlan-id

The VLAN identifier field (VID). Decimal number from 0 to 4095.


                            ebtables --vlan-id ...

--vlan-prio

The user priority field, a decimal number from 0 to 7. The VID should be set to 0 ("null VID") or unspecified (in the lattercase the VID is deliberately set to 0).


                            ebtables --vlan-prio ...

--vlan-encap

The encapsulated Ethernet frame type/length. Specified as a hexadecimal number from 0x0000 to 0xFFFF or as a symbolic namefrom /etc/ethertypes.WATCHER EXTENSIONSWatchers only look at frames passing by, they don't modify them nor decide to accept the frames or not. These watchers only see theframe if the frame matches the rule, and they see it before the target is executed.logThe log watcher writes descriptive data about a frame to the syslog.


                            ebtables --vlan-encap ...

--log

Log with the default loggin options: log-level= info, log-prefix="", no ip logging, no arp logging.


                            ebtables --log ...

--log-level

Defines the logging level. For the possible values, see ebtables -h log. The default level is info.


                            ebtables --log-level ...

--log-prefix

Defines the prefix text to be printed at the beginning of the line with the logging information.


                            ebtables --log-prefix ...

--log-ip

Will log the ip information when a frame made by the ip protocol matches the rule. The default is no ip information logging.


                            ebtables --log-ip ...

--log-ip6

Will log the ipv6 information when a frame made by the ipv6 protocol matches the rule. The default is no ipv6 information log‐ging.


                            ebtables --log-ip6 ...

--log-arp

Will log the (r)arp information when a frame made by the (r)arp protocols matches the rule. The default is no (r)arp informa‐tion logging.nflogThe nflog watcher passes the packet to the loaded logging backend in order to log the packet. This is usually used in combinationwith nfnetlink_log as logging backend, which will multicast the packet through a netlink socket to the specified multicast group. Oneor more userspace processes may subscribe to the group to receive the packets.


                            ebtables --log-arp ...

--nflog

Log with the default logging options


                            ebtables --nflog ...

--nflog-group

The netlink group (1 - 2^32-1) to which packets are (only applicable for nfnetlink_log). The default value is 1.


                            ebtables --nflog-group ...

--nflog-prefix

A prefix string to include in the log message, up to 30 characters long, useful for distinguishing messages in the logs.


                            ebtables --nflog-prefix ...

--nflog-range

The number of bytes to be copied to userspace (only applicable for nfnetlink_log). nfnetlink_log instances may specify theirown range, this option overrides it.


                            ebtables --nflog-range ...

--nflog-threshold

Number of packets to queue inside the kernel before sending them to userspace (only applicable for nfnetlink_log). Higher val‐ues result in less overhead per packet, but increase delay until the packets reach userspace. The default value is 1.ulogThe ulog watcher passes the packet to a userspace logging daemon using netlink multicast sockets. This differs from the log watcherin the sense that the complete packet is sent to userspace instead of a descriptive text and that netlink multicast sockets are usedinstead of the syslog. This watcher enables parsing of packets with userspace programs, the physical bridge in and out ports arealso included in the netlink messages. The ulog watcher module accepts 2 parameters when the module is loaded into the kernel (e.g.with modprobe): nlbufsiz specifies how big the buffer for each netlink multicast group is. If you say nlbufsiz=8192, for example, upto eight kB of packets will get accumulated in the kernel until they are sent to userspace. It is not possible to allocate more than128kB. Please also keep in mind that this buffer size is allocated for each nlgroup you are using, so the total kernel memory usageincreases by that factor. The default is 4096. flushtimeout specifies after how many hundredths of a second the queue should beflushed, even if it is not full yet. The default is 10 (one tenth of a second).


                            ebtables --nflog-threshold ...

--ulog

Use the default settings: ulog-prefix="", ulog-nlgroup=1, ulog-cprange=4096, ulog-qthreshold=1.


                            ebtables --ulog ...

--ulog-prefix

Defines the prefix included with the packets sent to userspace.


                            ebtables --ulog-prefix ...

--ulog-nlgroup

Defines which netlink group number to use (a number from 1 to 32). Make sure the netlink group numbers used for the iptablesULOG target differ from those used for the ebtables ulog watcher. The default group number is 1.


                            ebtables --ulog-nlgroup ...

--ulog-cprange

Defines the maximum copy range to userspace, for packets matching the rule. The default range is 0, which means the maximumcopy range is given by nlbufsiz. A maximum copy range larger than 128*1024 is meaningless as the packets sent to userspacehave an upper size limit of 128*1024.


                            ebtables --ulog-cprange ...

--ulog-qthreshold

Queue at most threshold number of packets before sending them to userspace with a netlink socket. Note that packets can besent to userspace before the queue is full, this happens when the ulog kernel timer goes off (the frequency of this timerdepends on flushtimeout).TARGET EXTENSIONSarpreplyThe arpreply target can be used in the PREROUTING chain of the nat table. If this target sees an ARP request it will automaticallyreply with an ARP reply. The used MAC address for the reply can be specified. The protocol must be specified as ARP. When the ARPmessage is not an ARP request or when the ARP request isn't for an IP address on an Ethernet network, it is ignored by this target(CONTINUE). When the ARP request is malformed, it is dropped (DROP).


                            ebtables --ulog-qthreshold ...

--arpreply-mac

Specifies the MAC address to reply with: the Ethernet source MAC and the ARP payload source MAC will be filled in with thisaddress.


                            ebtables --arpreply-mac ...

--arpreply-target

Specifies the standard target. After sending the ARP reply, the rule still has to give a standard target so ebtables knowswhat to do with the ARP request. The default target is DROP.dnatThe dnat target can only be used in the BROUTING chain of the broute table and the PREROUTING and OUTPUT chains of the nat table. Itspecifies that the destination MAC address has to be changed.


                            ebtables --arpreply-target ...

--to-destination

Change the destination MAC address to the specified address. The flag --to-dst is an alias for this option.


                            ebtables --to-destination ...

--dnat-target

Specifies the standard target. After doing the dnat, the rule still has to give a standard target so ebtables knows what to dowith the dnated frame. The default target is ACCEPT. Making it CONTINUE could let you use multiple target extensions on thesame frame. Making it DROP only makes sense in the BROUTING chain but using the redirect target is more logical there. RETURNis also allowed. Note that using RETURN in a base chain is not allowed (for obvious reasons).markThe mark target can be used in every chain of every table. It is possible to use the marking of a frame/packet in both ebtables andiptables, if the bridge-nf code is compiled into the kernel. Both put the marking at the same place. This allows for a form of commu‐nication between ebtables and iptables.


                            ebtables --dnat-target ...

--mark-set

Mark the frame with the specified non-negative value.


                            ebtables --mark-set ...

--mark-or

Or the frame with the specified non-negative value.


                            ebtables --mark-or ...

--mark-and

And the frame with the specified non-negative value.


                            ebtables --mark-and ...

--mark-xor

Xor the frame with the specified non-negative value.


                            ebtables --mark-xor ...

--mark-target

Specifies the standard target. After marking the frame, the rule still has to give a standard target so ebtables knows what todo. The default target is ACCEPT. Making it CONTINUE can let you do other things with the frame in subsequent rules of thechain.redirectThe redirect target will change the MAC target address to that of the bridge device the frame arrived on. This target can only beused in the BROUTING chain of the broute table and the PREROUTING chain of the nat table. In the BROUTING chain, the MAC address ofthe bridge port is used as destination address, in the PREROUTING chain, the MAC address of the bridge is used.


                            ebtables --mark-target ...

--redirect-target

Specifies the standard target. After doing the MAC redirect, the rule still has to give a standard target so ebtables knowswhat to do. The default target is ACCEPT. Making it CONTINUE could let you use multiple target extensions on the same frame.Making it DROP in the BROUTING chain will let the frames be routed. RETURN is also allowed. Note that using RETURN in a basechain is not allowed.snatThe snat target can only be used in the POSTROUTING chain of the nat table. It specifies that the source MAC address has to bechanged.


                            ebtables --redirect-target ...

--to-source

Changes the source MAC address to the specified address. The flag --to-src is an alias for this option.


                            ebtables --to-source ...

--snat-target

Specifies the standard target. After doing the snat, the rule still has to give a standard target so ebtables knows what todo. The default target is ACCEPT. Making it CONTINUE could let you use multiple target extensions on the same frame. Makingit DROP doesn't make sense, but you could do that too. RETURN is also allowed. Note that using RETURN in a base chain is notallowed.


                            ebtables --snat-target ...

--snat-arp

Also change the hardware source address inside the arp header if the packet is an arp message and the hardware address lengthin the arp header is 6 bytes.FILES/etc/ethertypes /run/ebtables.lockENVIRONMENT VARIABLESEBTABLES_ATOMIC_FILEMAILINGLISTSSee http://netfilter.org/mailinglists.html


                            ebtables --snat-arp ...