Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working with kvm 0.14.1 on an ubuntu lucid x64 box. I've got 3 vlans configured, one that is a bridge to the host's eth1. The others are host only.

I want to start playing with snort. Is there a way to configure a 'mirror' port into/onto one of the vlans from/to a kvm virtual machine ?

thanks in advance.

share|improve this question
+1 for interesting question. – Kvisle Oct 21 '11 at 5:03

if I understand what you're after, then all you need to do is build a bridge on the vlan you want to listen to, and add a NIC to the VM, that will be plugged into that bridge. The reason is simple - bridged interfaces are set in promiscous mode, and should be forwarding all bcast traffic to the VM.

share|improve this answer
hm...considered this but I don't think that will exactly do what I want. I'm basically trying to replicate Cisco's SPAN (aka port mirroring). – user52874 Oct 28 '11 at 23:05
that said, I'm thinking something like openvswitch may be an easy way to go. – user52874 Oct 28 '11 at 23:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.