[Xen-users] Running snort on dom0

[Torsten Lehmann <tlehmann@xxxxxxxxxxxxx>]

> I need to monitor all traffic and block bad requests on my guest
> machines and also on my xen host. To accomplish this I think to
> install snort on my dom0 host (rhel5). Somebody have
> tried this? What about performance on guests??

- work identical to fw,sniffer,net-acct...

  --- peth0  ---- eth0 ----- dom0
              |
              --- vif1.0 --- dom1

- snort read default from eth0
- would you scan complete traffic, bind snort to peth0
- would you scan dom1, bind snort to vif1.0

Torsten


--
Torsten lehmann
Launoc


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users