This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-users] Snort monitoring of Xen guests

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-users] Snort monitoring of Xen guests
From: Mark Chandler <mcl@xxxxxxxxxxx>
Date: Sun, 27 Apr 2008 15:22:37 +1000
Delivery-date: Sat, 26 Apr 2008 22:23:11 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Thunderbird (X11/20080226)
Hi all,

From another post on this list, it seems that the only way to monitor all traffic to guests in a host is to bind to the peth interface that is bound to the bridge that serves the guests. Is this the only way of doing it? Ideally, I'd like to have one guest running Snort that monitors everything else.

I've tried using tcpdump to monitor traffic on various interfaces, but I've never had a completely satisfactory result. On guest interfaces, I can only see traffic for that guest (this seems to be a feature); on Dom0 I get a long pause (10-20s), then I start to see packets. Also, with the Dom0 monitoring, I can only seem to see traffic on the peth interface. Binding to vif0.0 gives me nothing interesting.

At the moment, I'm researching the use of tc (traffic control) to mirror traffic to another device to get the effect of a monitor port on the xen-bridge.

Any help on this would be very appreciated.

Mark C.

Xen-users mailing list

<Prev in Thread] Current Thread [Next in Thread>