| |
|
 |
|
 |
|
|
|
| |
|
|
xen-users
Re: [Xen-users] Snort monitoring of Xen guests
John Haxby wrote:
Mark Chandler wrote:
Hi all,
From another post on this list, it seems that the only way to monitor
all traffic to guests in a host is to bind to the peth interface that
is bound to the bridge that serves the guests. Is this the only way
of doing it? Ideally, I'd like to have one guest running Snort that
monitors everything else.
ebtables is probably your friend. Something like
ebtables -t broute -A BROUTING -s <dom0 MAC> -j ACCEPT
ebtables -t broute -A BROUTING -d <dom0 MAC> -j ACCEPT
ebtables -t broute -A BROUTING -s <domU MAC> -j ACCEPT
ebtables -t broute -A BROUTING -d <domU MAC> -j ACCEPT
ebtables -t broute -A BROUTING -p IPv4 --ip-proto tcp -j dnat
--to-dst <domU MAC> --dnat-target ACCEPT
Where <domU MAC> is the MAC address of the guest you want to run snort
on. The first four rules ensure that traffic from dom0 and the
monitoring domU pass unimpeded through the bridge, the last rule
redirects all traffic TCP traffic to or from any other guest through
the monitoring domU.
Of course, it doesn't have to be a domU on this machine, it can be any
machine, virtual or otherwise, on the LAN since you're just
redirecting traffic at the layer 2 level. You'll probably want to do
more with the last rule as well, as you'll probably want some (or all)
UDP traffic redirected to the monitor but you might want to draw the
line at ICMP, ARP and Appletalk :-)
jch
Many thanks, John. I'll give that a go. At the very least it'll be fun
to experiment with ebtables! :-)
Mark C.
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
| |
|
Home