RE: [Xen-users] Snort monitoring of Xen guests

["James Harper" <james.harper@xxxxxxxxxxxxxxxx>]

>  From another post on this list, it seems that the only way to monitor
> all traffic to guests in a host is to bind to the peth interface that
is
> bound to the bridge that serves the guests.

That will only catch traffic that goes via peth. Anything from DomU to
DomU will be missed. That is probably acceptable though if you are only
interested in traffic from external to DomU.

I don't think there is an option in the Linux bridge code to have a
'mirror' port that sees everything, unless maybe you can run snort on
the xenbrX interface itself?

James

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users