Abstract
OK, the idea is to use a hub. But what is a hub? In the good old networking days they where used to distribute network traffic. Incoming traffic was sent through all its connected ports - of course, with very bad performance for only addressing one device on unicast. That was the reason why switches are made. They remember the mac addresses behind its ports (what devices are connected to the port) and switch incoming traffic only to the port with the destination mac address of the ethernet package. But on RasPi2 we want to see all traffic, not only that is addressed to itself.
Usually the Linux bridge is working as a switch by default. But fortunately we can configure it to behave like a hub. There is a timeout AgeingTimeSec, how long the switch shall remember the mac addresses before renewing them. If setting it to 0 the bridge doesn't know what port to use and must send packages through all its ports.
Setup
First attach the spare USB/wired ethernet dongle to RasPi1 so you have interfaces eth0, eth1, eth2 (the dongle) and wlan0 on it. On RasPi2 you just have its built-in interfaces eth0 and wlan0. Connect the two RasPis with an ethernet cable. To configure the network I will use systemd-networkd because it has all things available and simplify setup a lot. We can just configure it and don't need additional helpers.
I started with a fresh flashed Raspbian Buster Light. Then Use systemd-networkd for general networking for RasPi1 and RasPi2 but execute only the section ♦ Quick Step and come back here.
Setup WiFi on both RasPis with these 2 files and your settings for country, ssid and psk:
rpi ~$ sudo -Es # if not already set
rpi ~# cat > /etc/wpa_supplicant/wpa_supplicant-wlan0.conf <<EOF
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=DE
network={
ssid="TestNet"
psk="verySecretPassword"
key_mgmt=WPA-PSK
proto=RSN WPA
}
EOF
rpi ~# systemctl disable wpa_supplicant.service
rpi ~# systemctl enable wpa_supplicant@wlan0.service
rpi ~# chmod 600 /etc/wpa_supplicant/wpa_supplicant-wlan0.conf
rpi ~# sudo rfkill unblock 0
rpi ~# cat > /etc/systemd/network/08-wifi.network <<EOF
[Match]
Name=wl*
[Network]
LLMNR=no
# Option using a DHCP server
DHCP=yes
# Option using link-local ip addresses
#LinkLocalAddressing=yes
#MulticastDNS=yes
# Option use static ip address (use your settings)
#Address=192.168.50.61/24
#Gateway=192.168.50.1
#DNS=84.200.69.80 1.1.1.1
EOF
To configure the ethernet interfaces on RasPi1 create these 4 files and reboot:
rpi1 ~$ sudo -Es
rpi1 ~# cat > /etc/systemd/network/02-br0.netdev <<EOF
[NetDev]
Name=br0
Kind=bridge
[Bridge]
AgeingTimeSec=0
STP=false
EOF
rpi1 ~# cat > /etc/systemd/network/04-br0_add-eth.network <<EOF
[Match]
Name=eth*
[Network]
LLMNR=no
Bridge=br0
EOF
rpi1 ~# cat > /etc/systemd/network/12-br0_up.network <<EOF
[Match]
Name=br0
[Network]
LLMNR=no
EOF
To configure the ethernet interface on RasPi2 create this file and reboot:
rpi2 ~$ sudo -Es
rpi2 ~# cat > /etc/systemd/network/04-eth.network <<EOF
[Match]
Name=e*
[Network]
LLMNR=no
EOF
Please note that there are no ip addresses on the wired interfaces. After reboots you should be able to watch all traffic on the broadcast domain (merged interfaces) from all interfaces, e.g. with tcpdump:
rpi1 ~$ sudo tcpdump -n -i br0
rpi2 ~$ sudo tcpdump -n -i eth0
Troubleshooting
Show details of the bridges interfaces:
rpi1 ~$ bridge -d link
Show details of the bridge:
rpi1 ~$ ip -d link show br0
rpi1 ~$ ip -d link show br0 | grep -Po 'ageing_time .*? '
ageing_time 0
# or better
rpi1 ~$ find /sys/class/net/br0/bridge/ -type f -readable -printf '%f = ' -exec cat {} \; | sort
All incoming packages are send to all other ports. So for example packages from eth0 will also be (re)send through eth1 back to the Network TAP. If this confuses the device you can use ebtables to filter the traffic on the bridge, similar to use iptables.
