I have created a namespace and a bridge that join the namespace to the host.

The setup is as below:

#setup a bridge v-net-0
sudo ip link add v-net-0 type bridge
sudo ip link set dev v-net-0 up
sudo ip addr add 192.168.15.1/24 dev v-net-0

sudo ip netns add red
#create namespace red and a veth veto-red to red
sudo ip link add veth-red type veth peer name veth-red-br
sudo ip link set veth-red netns red
sudo ip link set veth-red-br master v-net-0
#assign IP to veth-red
sudo ip -n red addr add 192.168.15.20/24 dev veth-red
sudo ip -n red link set veth-red up
sudo ip link set veth-red-br up
sudo ip netns exec red ip route add default via 192.168.15.1

#create a link blue, a veth that
sudo ip link add veth-blue type veth peer name veth-blue-br
sudo ip link set veth-blue-br master v-net-0
sudo ip addr add 192.168.15.100 dev veth-blue
sudo ip link set veth-blue up
sudo ip link set veth-blue-br up

I was able to ping 192.168.15.100 within ns red and 192.168.15.20 from the host.
My questions are:

1. Using Wireshark, while I can captured the ICMP traffic by monitoring v-net-0 and veth-red-br, I was not able to when monitoring on either veth-blue-br or veth-blue. Through what route was the ICMP message route to the host?
2. I have a module that operates by monitor a specific message through monitoring of a ethernet port, which I have configured to monitor on veth-blue. Is there a way to workaround it?

Look forward to some advice from the community.

Thanks