[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-users] Re: Snort on domU

To: Dot Yet <dot.yet@xxxxxxxxx>
From: David Edmondson <dme@xxxxxxx>
Date: Fri, 26 Jun 2009 11:09:50 +0100
Cc: xen-discuss@xxxxxxxxxxxxxxx, xen-users@xxxxxxxxxxxxxxxxxxx
Delivery-date: Fri, 26 Jun 2009 07:37:06 -0700
List-id: Xen user discussion <xen-users.lists.xensource.com>

* dot.yet@xxxxxxxxx [2009-06-25 23:08:41]
> Can anyone confirm if a xen based domU can be used for snort setup? It is
> not for commercial use, rather just SOHO use.

You can run snort in a guest, but it won't see all of the traffic from
the wire.

It gets:
    - traffic to its' MAC address,
    - traffic with the multicast bit set in the destination address.

In most cases this makes it unusable for snort.

dme.
-- 
David Edmondson, Sun Microsystems, http://dme.org

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

Follow-Ups:
- [Xen-users] Re: [xen-discuss] Snort on domU
  - From: Fajar A. Nugraha

References:
- [Xen-users] Snort on domU
  - From: Dot Yet

Prev by Date: [Xen-users] Determining where a DomU lives?
Next by Date: Re: [Xen-users] xm documentation
Previous by thread: [Xen-users] Snort on domU
Next by thread: [Xen-users] Re: [xen-discuss] Snort on domU
Index(es):
- Date
- Thread

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.