I'm working with kvm 0.14.1 on an ubuntu lucid x64 box. I've got 3 vlans configured, one that is a bridge to the host's eth1. The others are host only.

I want to start playing with snort. Is there a way to configure a 'mirror' port into/onto one of the vlans from/to a kvm virtual machine ?

thanks in advance.

  • +1 for interesting question. – Kvisle Oct 21 '11 at 5:03

if I understand what you're after, then all you need to do is build a bridge on the vlan you want to listen to, and add a NIC to the VM, that will be plugged into that bridge. The reason is simple - bridged interfaces are set in promiscous mode, and should be forwarding all bcast traffic to the VM.

  • hm...considered this but I don't think that will exactly do what I want. I'm basically trying to replicate Cisco's SPAN (aka port mirroring). – user52874 Oct 28 '11 at 23:05
  • that said, I'm thinking something like openvswitch may be an easy way to go. – user52874 Oct 28 '11 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.