Forum Mihai Moldovan

Update and install usb-modeswitch:

apt update && sudo apt install usb-modeswitch -y

Create FIx service:

Code: Select all

vim /etc/systemd/system/nic-fix.service

Add configuration:

Code: Select all

[Unit]
Description=Fix Realtek USB NIC Mode
After=network.target

[Service]
Type=oneshot
# ExecStart=/usr/sbin/usb_modeswitch -v 0bda -p 8151 -R # For executing only once
ExecStart=/bin/bash -c 'for i in {1..2}; do /usr/sbin/usb_modeswitch -v 0bda -p 8151 -R; sleep 1; done' # Executing command 2 times since there are 2 x USB NIC's the same version
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

Enable the service:

Code: Select all

systemctl daemon-reload
sudo systemctl enable nic-fix.service
sudo systemctl start nic-fix.service

Netplan configuration for bridge interface and adding the 2 x NIC's with stealth configuration:

Create netplan configuration file:

Code: Select all

vim systemctl daemon-reload

Add the following configuration and save:

Code: Select all

network:
  version: 2
  renderer: networkd
  ethernets:
    eth1:
      dhcp4: false
      dhcp6: false
      accept-ra: false
      link-local: [ ] # Disables IPv6 auto-config for stealth
      # Disable Hardware Offloading
      receive-checksum-offload: false
      transmit-checksum-offload: false
      generic-receive-offload: false
      generic-segmentation-offload: false
    eth2:
      dhcp4: false
      dhcp6: false
      accept-ra: false
      link-local: [ ] # Disables IPv6 auto-config for stealth
      # Disable Hardware Offloading
      receive-checksum-offload: false
      transmit-checksum-offload: false
      generic-receive-offload: false
      generic-segmentation-offload: false
  bridges:
    br0:
      interfaces: [eth1, eth2]
      dhcp4: false  # Usually false for a pure sniffer to stay "stealth"
      dhcp6: false
      link-local: [ ] 
      parameters:
        stp: false           # Critical: Disable STP for instant forwarding
        forward-delay: 0     # Critical: Remove delay for sniffing

Enable Promiscuous Mode for bridge interface and NIC's:

Code: Select all

ip link set eth1 promisc on
ip link set eth2 promisc on
ip link set br0 promisc on

Fix the file Permissions:

Code: Select all

chmod 600 /etc/netplan/99-usb-bridge.yaml
chmod 600 /lib/netplan/00-network-manager-all.yaml

Apply configuration:

Code: Select all

netplan apply

Check the bridge interface:

Code: Select all

brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.02ea39686411       no              eth1
                                                        eth2

Check the link of the bridge network:

Code: Select all

ip link show br0

Check the links for each interface assigned to br0:

Code: Select all

ip link show master br0

Check the bridge forwarding table:

Code: Select all

bridge fdb show br0

Check the bridge traffic flow:

Code: Select all

ip -s link show br0

Capture test on br0:

Code: Select all

tcpdump -i br0 -nn -vv

Forum Mihai Moldovan

USB NICs not recognized: Debian 13

USB NICs not recognized: Debian 13