up vote 1 down vote favorite
2
share [g+] share [fb]

I'm running KVM on Centos 5. I have a guest OS, ubuntu 10.04, that has Snort 2.9 installed on it. The guest OS has (2) nic's, eth0 and eth1. One nic, eth0, is configured with an IP and can be accessed from the network that the host OS is on. The 2nd nic has no IP, and is used to receive mirrored traffic from a Cisco switch. On the host OS side, a tcpdump on br1, which is the bridge interface used for the guest OS running Snort, does see the mirrored traffic from the switch. But a tcpdump run on eth1 of the guest OS, which is the interface that's monitored by Snort, only sees broadcast or cdp packets from the switch. A tcpdump run on eth0 of the guest OS does show the mirrored traffic from the switch.

Any ideas?

link|improve this question
Try checking for a KVM setting to allow the guest to use promiscuous mode. – devicenull Oct 5 '11 at 23:57
devicenull, I found the KVM setting to put an interface into promiscuous mode, but it didn't work. I applied the setting to the bridge interface, br1, and ran a tcpdump on both eth0 and eth1 of the guest os, and saw only broadcast or cdp traffic. Also, I was mistaken about eth0 on the guest os. This interface is only seeing broadcast traffic, or traffic for snort, since snort is currently configured to monitor eth0. – user97026 Oct 6 '11 at 20:14
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.