BRCONFIG(8)             OpenBSD System Manager's Manual            BRCONFIG(8)

NAME
     brconfig - manipulate bridge interfaces

SYNOPSIS
     brconfig -a
     brconfig bridge-name [up] [down] [addr] [add interface-name] [delete
              interface-name] [maxaddr size] [timeout time] [static interface-
              name address] [deladdr address] [flush] [flushall] [discover
              interface-name] [-discover interface-name] [learn
              interface-name] [-learn interface-name] [link0] [link1] [-link0]
              [-link1] [...]

DESCRIPTION
     The brconfig utility retrieves kernel state of bridge interfaces and al-
     lows user control of these bridges.  In the first synopsis, the command
     will list the status of all bridges in the system.  In the second, its
     command line consists of the name of a bridge and a set of operations to
     be performed on that bridge.  The commands are executed in the order they
     were specified.  If no command is specified in the second synopsis, the
     brconfig will display status information about the bridge.

     The available commands are:

     up      Start the bridge forwarding packets.

     down    Stop the bridge from forwarding packets.

     addr    Display the addresses that have been learned by the bridge.

     add interface-name
             Add the interface named by interface-name as a member of the
             bridge.  The interface is put into promiscuous mode so that it
             can receive every packet sent on the network.

     delete interface-name
             Remove the interface named by interface-name from the bridge.
             Promiscuous mode is turned off for the interface when it is re-
             moved from the bridge.

     del     Alias for `delete'.

     maxaddr size
             Set the address cache size to size. The default is 100 entries.

     timeout time
             Set the timeout, in seconds, for addresses in the cache to time.
             The default is 240 seconds.  If time is set to zero, then entries
             will not be expired.

     static interface-name address
             Add a static entry into the address cache pointing to interface-
             name. Static entries are never aged out of the cache or replaced
             if the address is seen on a different interface.

     deladdr address
             Delete an address from the cache.

     flush   Remove all dynamically learned addresses from the cache.

     flushall
             Remove all addresses from the cache including static addresses.

     discover interface
             Mark an interface so that packets are sent out of the interface
             if the destination port of the packet is unknown.  If the bridge
             has no address cache entry for the destination of a packet, mean-
             ing that there is no static entry and no dynamically learned en-
             try for the destination, the bridge will forward the packet to
             all member interfaces that have this flag set.  This is the de-
             fault for interfaces added to the bridge.

     -discover interface
             Mark an interface so that packets are not sent out of the inter-
             face if the destination port of the packet is unknown.  Turning
             this flag off means that the bridge will not send packets out of
             this interface unless the packet is a broadcast packet, multicast
             packet, or a packet with a destination address found on the in-
             terface's segment.  This, in combination with static address
             cache entries, prevents potentially sensitive packets from being
             sent on segments that have no need to see the packet.

     learn interface
             Mark an interface so that the source address of packets received
             from interface are entered into the address cache.  This is the
             default for interfaces added to the bridge.

     -learn interface
             Mark an interface so that the source address of packets received
             from interface are not entered into the address cache.

     link0   Setting this flag stops all non-IP multicast packets from being
             forwarded by the bridge.

     -link0  Clear the link0 flag on the bridge interface.

     link1   Setting this flags stops all IP multicast packets from being for-
             warded by the bridge.

     -link0  Clear the link1 flag on the bridge interface.

EXAMPLES
     brconfig bridge0 add rl0 add xl0 up
               Add the Ethernet interfaces rl0 and xl0 to the bridge bridge0,
               and start the bridge forwarding packets.

     brconfig bridge0
               Retrieve a list of interfaces that are members of bridge0, and
               the addresses learned by the bridge.

     brconfig bridge0 down
               Stop bridge0 from forwarding packets.

     brconfig bridge0 delete xl0
               Remove the interface xl0 from the bridge bridge0.

     brconfig bridge0 flush
               Flush all dynamically learned addresses from the address cache.

     brconfig bridge0 flushall
               Remove all addresses, including static addresses, from the ad-
               dress cache.

     brconfig bridge0 -learn xl0 static xl0 8:0:20:1e:2f:2b

     brconfig bridge0 -discover xl0
               The examples above mark the xl0 interface so that it will not
               learn addresses and adds a static entry for the host
               8:0:20:1e:2f:2b on the xl0 segment.  Finally, xl0 is marked so
               that it will not receive packets with destinations not found in
               the address cache of bridge0.  This setup is the most secure,
               and means that bogus MAC addresses seen by the xl0 side of the
               bridge will not be propagated to the rest of the network.  Al-
               so, no packets will be sent on xl0 segment by the bridge unless
               they are broadcast packets or are for 8:0:20:1e:2f:2b.

SEE ALSO
     bridge(4),  ifconfig(8)

HISTORY
     brconfig first appeared in OpenBSD 2.5.

AUTHOR
     The brconfig(8) command and the bridge(4) kernel interface were written
     by Jason L. Wright <jason@thought.net> as part of an undergraduate inde-
     pendent study at the University of North Carolina at Greensboro.

BUGS
     There are some rather special network interface chipsets which will not
     work in a bridge configuration.  Some, like the Lite-On PNIC (see pn(4)),
      have serious flaws when running in promiscuous mode, and others, like
     the TI ThunderLAN (see tl(4)),  receive their own transmissions, which
     makes the address learning code ineffective.  Most other chipsets work
     fine though.

OpenBSD 2.6                    February 26, 1999                             3
