WindowsPacketFilter/Tools/ebridge not working

[littlefooch]

I installed WindowsPacketFilter on Win 10 20H2. I executed ebridge.exe in a command window. Command appeared to work, no bridge noted on IPCONFIG /all or Network Connections.

What am I doing incorrectly?
Thanks

[Vadim Smirnov]

Ebridge implements the transparent bridge and thus it does not affect ipconfig output.

[littlefooch]

I tested after setting up a 2 adapter bridge (these are Thunderbolt adapters).

When set up, cannot ping across the bridge, so doesn’t seem to be working.

Here’s the scenario:
1. Connect three Win 10 20H2 machines via Thunderbolt Networking
2. the middle machine exposes the TB Adapter from each neighbor
3. Bridging the three together via the middle man works for existing ‘Bridge Connections’ from the Network Connections UI (after much fuss and redo)
4. Disable all other network connections to the lan (ethernet and wifi adapters)
4. Test is to invoke each neighbor using //name.local which yields the file explorer for each neighbor, once at a time of course.
5. Of course each neighbor can be pinged by ping name.local

These tests do not work after setting up the transparent bridge

Any suggestions?
Thanks
LF

[Vadim Smirnov]

I have tested Ethernet Bridge sample only over Ethernet and WiFi adapters and if you look through this paper then bridging WiFi was a tricky task (required MAC level address translation). I have never tested Ethernet Bridge over Thunderbolt, but I suspect that it has its own specifics which should taken into account.

[littlefooch]

Thanks for your reply.
I’m happy to test if you decide to look further into the bridging of Thunderbolt adapters.

LF

[Vadim Smirnov]

I don’t have the hardware to test with on my side, so let’s try to look at what is going on the network layer. Here is the Debug build of Ethernet Bridge which saves packets capture from all bridged adapters. Try to test it with Thunderbolt (e.g. send pings from the one host connected to the bridge to another one) and send me PCAP files and ‘ipconfig /all’ output.

[littlefooch]

Thanks Vadim, I’ll get to it tomorrow.

I hit the debug build link and it went off into lala land with no download (after all it is MS)

[littlefooch]

correction, got it after a second try

[littlefooch]

results are available in a zip

note that I disabled all adapters other than TB3
PCAP result names seem to indicate that selected adapters by number were not actually selected by ebridge

how to return results to you? see no way to attach zip. Google Drive share will required email, thanks

[Vadim Smirnov]

Does ebridge displays your TB adapters at all or they are just ignored by software? If it does not then probably I do need to add TB medium support first. Could you please run ‘listadapters’ from the standard tools and share its output?

You can share Google driver to my gmail.com account ‘gmkernel’.

[littlefooch]

resent as pilot error on adapter selection in first set of results.
second set just sent

do you still need ‘listadapters’

[Vadim Smirnov]

From what I can see ebridge can see both TB connections, so lets keep the ‘listadapters’ aside.

As I can see both TB adapters on the central host have auto-configured IP addresses and pinging by name does not work. Could you assign all TB adapters some fixed IPv4 addresses and try to ping over the bridge? E.g.

PC1-TB [10.0.0.1/24] <–> [10.0.0.2/24]TB1-PC2-TB2[10.0.0.3/24] <–> [10.0.0.4] TB-PC3

Then try to ping 10.0.0.4 from 10.0.0.1 and vice versa while running the ebridge. If bridge works then you should be able to, if not then send me captures to look what is going wrong.

[littlefooch]

FYI, I tested a little more using latest Win 11 Insider release, not working per ping testing.

I can hack the ‘bridge connections’ on Win to get the bridge to work (luck and retries) – I block all adapters on one host with only the TB adapter bridge to communicate via ping when I test.

I was wondering if knowing the state of the interfaces in the registry for the connected adapters might be helpful by comparing what you know for how the adapters ‘should’ look with ebridge and how they look in the registry after hacking bridge.

LF

[Vadim Smirnov]

Regretfully I don’t have TB adapters to test with, but probably TB somehow differs from the ‘normal’ Ethernet. Technically it is emulation of 802.3 media over TB bus, so I would not be surprised if TB adapter simply ignores any network packets having MAC address from another TB adapter.

In some approximation this could be similar to the situation when bridge works between wired Ethernet and WiFi where I had to translate wired Ethernet MAC addresses to WiFi and vice versa so that packets from the wired segment would not be rejected by an Access Point.

But these are just raw ideas based on my previous experience, I don’t have the relevant hardware to test with.

[Author]

Posts