Re: [Xen-users] Snort monitoring of Xen guests

[John Haxby <john.haxby@xxxxxxxxxx>]

Mark Chandler wrote:
> Hi all,
>
> From another post on this list, it seems that the only way to monitor 
> all traffic to guests in a host is to bind to the peth interface that 
> is bound to the bridge that serves the guests. Is this the only way of 
> doing it? Ideally, I'd like to have one guest running Snort that 
> monitors everything else.
ebtables is probably your friend.   Something like

   ebtables -t broute -A BROUTING -s <dom0 MAC> -j ACCEPT
   ebtables -t broute -A BROUTING -d <dom0 MAC> -j ACCEPT
   ebtables -t broute -A BROUTING -s <domU MAC> -j ACCEPT
   ebtables -t broute -A BROUTING -d <domU MAC> -j ACCEPT
   ebtables -t broute -A BROUTING -p IPv4 --ip-proto tcp -j dnat 
--to-dst <domU MAC> --dnat-target ACCEPT
Where <domU MAC> is the MAC address of the guest you want to run snort 
on.  The first four rules ensure that traffic from dom0 and the 
monitoring domU pass unimpeded through the bridge, the last rule 
redirects all traffic TCP traffic to or from any other guest through the 
monitoring domU.
Of course, it doesn't have to be a domU on this machine, it can be any 
machine, virtual or otherwise, on the LAN since you're just redirecting 
traffic at the layer 2 level.  You'll probably want to do more with the 
last rule as well, as you'll probably want some (or all) UDP traffic 
redirected to the monitor but you might want to draw the line at ICMP, 
ARP and Appletalk :-)
jch

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users