RE: [Xen-users] Snort monitoring of Xen guests

["Nick Couchman" <Nick.Couchman@xxxxxxxxx>]

Well, I'm not familiar with SNORT, but you can tcpdump on a bridge interface, 
so I don't know why snort wouldn't work.  This should allow you to pick up all 
traffic that goes across the bridge.

-Nick

>>> On Tue, Apr 29, 2008 at  6:45 AM, "James Harper" 
>>> <james.harper@xxxxxxxxxxxxxxxx> wrote:

>  From another post on this list, it seems that the only way to monitor
> all traffic to guests in a host is to bind to the peth interface that
is
> bound to the bridge that serves the guests.

That will only catch traffic that goes via peth. Anything from DomU to
DomU will be missed. That is probably acceptable though if you are only
interested in traffic from external to DomU.

I don't think there is an option in the Linux bridge code to have a
'mirror' port that sees everything, unless maybe you can run snort on
the xenbrX interface itself?

James






This e-mail may contain confidential and privileged material for the sole use 
of the intended recipient.  If this email is not intended for you, or you are 
not responsible for the delivery of this message to the intended recipient, 
please note that this message may contain SEAKR Engineering (SEAKR) 
Privileged/Proprietary Information.  In such a case, you are strictly 
prohibited from downloading, photocopying, distributing or otherwise using this 
message, its contents or attachments in any way.  If you have received this 
message in error, please notify us immediately by replying to this e-mail and 
delete the message from your mailbox.  Information contained in this message 
that does not relate to the business of SEAKR is neither endorsed by nor 
attributable to SEAKR.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users