RE: [Xen-users] layer2

["James Harper" <james.harper@xxxxxxxxxxxxxxxx>]

> 
> Back with UML you needed to use ebtables to filter traffic on each
servers
> TAP interface so that one domain could not sniff another domains
traffic.
> This doesnt look to need to be done on Xen?  Whats difference, looks
like
> the same setup, TAP interfaces connected to a bridge.
> 

A bridge acts like a switch, so unless someone is doing ARP spoofing or
something, a DomU should only get packets with their own MAC address as
the destination (and Multicast and Broadcast packets of course).

You could add ebtables rules to make sure it can't happen at all, but as
a general rule it shouldn't be necessary.

James

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users