Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to set up two different systems that will monitor network traffic, but have only one monitor/mirror port available on our central switch. I was hoping that I could install both systems as separate domains on the same kvm box, and configure each to listen on the network adapter connected to the monitor/mirror port on the switch.

Does anyone know if it's possible to have 2 VMs share the same NIC in promiscuous mode such that each can sniff traffic on the network? Would I be better off connecting the monitor port to a hub (not a switch) to duplicate the traffic?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Update: I actually ended up going with KVM rather than Xen, but this does seem to work as the interfaces are bridged in promiscuous mode, so each domain sees all the traffic on that interface.

There are also specialized tap splitter devices whose sole purpose is to split and mirror traffic. They're not cheap, but it's another option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.