[Xen-users] Re: Snort on domU

To:	xen-discuss@xxxxxxxxxxxxxxx, xen-users@xxxxxxxxxxxxxxxxxxx
Subject:	[Xen-users] Re: Snort on domU
From:	Dot Yet <dot.yet@xxxxxxxxx>
Date:	Sat, 27 Jun 2009 22:16:13 -0400
Cc:
Delivery-date:	Sat, 27 Jun 2009 19:17:01 -0700
Dkim-signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:content-type; bh=NiYK0HPzAA5KwK/DH/o6YEw98j7o/PLPSzl429SwEJA=; b=YUHikd4WF2kW3tEE2dzBgrLNKdehGfC8Pn8fuPakVJUEhDDILqzbIv+9MHFU/1dokW kgrpoAzf9AbzGtSWudeH8jErubei5DzbHug7XNenEDBg1MvbWSPRejI1tK3mg8BgI+s/ XAhcjMKRACIII0qjoHclpg5VU83yeEUhwP5j8=
Domainkey-signature:	a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=AAfrR13E6cWXBALWyVd26OYWmYaS3sw9rCgKp6pZG7bVTQ8uX4bwC1vH91JGymmEjA 10gt1Y4s+kTEgO6PcRGIK2s7PkVYoCM4GeXfjwwrKVYTb1kPL1Rf+jhtxnzvT+QPBZjB EQLVacY2aO3S40xBRil1U8d73zNzCVus0ldTA=
Envelope-to:	www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to:	<87ljnf541r.fsf@xxxxxxxxxxxxxxx>
List-help:	<mailto:xen-users-request@lists.xensource.com?subject=help>
List-id:	Xen user discussion <xen-users.lists.xensource.com>
List-post:	<mailto:xen-users@lists.xensource.com>
List-subscribe:	<http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe:	<http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References:	<93bc4af40906251508o1d341f67w160aef549a9c24be@xxxxxxxxxxxxxx> <87ws6z5ms1.fsf@xxxxxxxxxxxxxxx> <7207d96f0906260856h71895f9dn72f3ac7a0d81ecf5@xxxxxxxxxxxxxx> <87ljnf541r.fsf@xxxxxxxxxxxxxxx>
Sender:	xen-users-bounces@xxxxxxxxxxxxxxxxxxx

So does that mean the Crossbow project on opensolaris does not cater to this kind of requirement yet?

rgds,

dot.yet

On Fri, Jun 26, 2009 at 12:54 PM, David Edmondson <dme@xxxxxxx> wrote:

* fajar@xxxxxxxxx [2009-06-26 16:56:40]

> On Fri, Jun 26, 2009 at 5:09 PM, David Edmondson<dme@xxxxxxx> wrote:
>> * dot.yet@xxxxxxxxx [2009-06-25 23:08:41]
>>> Can anyone confirm if a xen based domU can be used for snort setup? It is
>>> not for commercial use, rather just SOHO use.
>>
>> You can run snort in a guest, but it won't see all of the traffic from
>> the wire.
>>
>> It gets:
>> - traffic to its' MAC address,
>> - traffic with the multicast bit set in the destination address.
>>
>
> ... and how is this different from a physical server, connected to a
> switch? Won't the switch filter out packets not intended for mac
> addresses on a particular port?

Most switches do this, yes. In that case it's usually possible to put a
switch port into monitor mode, which means that it gets all
packets. This isn't currently possible with the Solaris VNIC
implementation.

dme.
--
David Edmondson, Sun Microsystems, http://dme.org

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

WARNING - OLD ARCHIVES

xen-users

[Xen-users] Re: Snort on domU