I'd like to set up two different systems that will monitor network traffic, but have only one monitor/mirror port available on our central switch. I was hoping that I could install both systems as separate domains on the same kvm box, and configure each to listen on the network adapter connected to the monitor/mirror port on the switch.
Does anyone know if it's possible to have 2 VMs share the same NIC in promiscuous mode such that each can sniff traffic on the network? Would I be better off connecting the monitor port to a hub (not a switch) to duplicate the traffic?