Re: [Xen-users] Snort monitoring of Xen guests

[Mark Chandler <mcl@xxxxxxxxxxx>]

John Haxby wrote:
> Mark Chandler wrote:
> > Hi all,
> >
> > From another post on this list, it seems that the only way to monitor 
> > all traffic to guests in a host is to bind to the peth interface that 
> > is bound to the bridge that serves the guests. Is this the only way 
> > of doing it? Ideally, I'd like to have one guest running Snort that 
> > monitors everything else.
> ebtables is probably your friend.   Something like
>
>    ebtables -t broute -A BROUTING -s <dom0 MAC> -j ACCEPT
>    ebtables -t broute -A BROUTING -d <dom0 MAC> -j ACCEPT
>    ebtables -t broute -A BROUTING -s <domU MAC> -j ACCEPT
>    ebtables -t broute -A BROUTING -d <domU MAC> -j ACCEPT
>    ebtables -t broute -A BROUTING -p IPv4 --ip-proto tcp -j dnat 
> --to-dst <domU MAC> --dnat-target ACCEPT
> Where <domU MAC> is the MAC address of the guest you want to run snort 
> on.  The first four rules ensure that traffic from dom0 and the 
> monitoring domU pass unimpeded through the bridge, the last rule 
> redirects all traffic TCP traffic to or from any other guest through 
> the monitoring domU.
> Of course, it doesn't have to be a domU on this machine, it can be any 
> machine, virtual or otherwise, on the LAN since you're just 
> redirecting traffic at the layer 2 level.  You'll probably want to do 
> more with the last rule as well, as you'll probably want some (or all) 
> UDP traffic redirected to the monitor but you might want to draw the 
> line at ICMP, ARP and Appletalk :-)
> jch
Many thanks, John. I'll give that a go. At the very least it'll be fun 
to experiment with ebtables! :-)
Mark C.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users