Figured this out just last week, but I can't find it now. Even printed it out. Can't find that either. Frustrating...so...help!

Configured a 'monitoring' nic on a kvm guest (running 'Security Onion, if it matters). I read (somewhere) that the default nic configuration for a kvm guest is to only pass broadcast traffic, multicast traffic, and traffic with the guest's mac as a destination. There is an option to override this behaviour, and pass all traffic. It's something like --mac-filtering=no, or --mac-restriction=no, or something like that. Worked beautifully.

Does this look at all familiar to anyone who can clue me in to the exact option syntax?


  • Can you clarify a little bit -- what OS is the KVM host? Also, if you can remember, was it an option in libvirt, or kvm/qemu-kvm, or something else (sysctl, ufw, etc)? – nedm Oct 19 '12 at 19:15
  • be happy to. It's a proxmox VE 2.1 host (proxmox.com/products/proxmox-ve ) patched to current-as-of-last-week. Proxmox is debian based. the option was a kvm option, because I ssh'ed into the proxmox box, copied/pasted the appropriate kvm commandline from 'ps ax' and added the option in the appropriate place. Unfortunately, I don't remember whether the appropriate place was -dev net, -dev tap, or something other network related option. Thanks! – user52874 Oct 21 '12 at 22:32

There's a few potential options in the network filters in libvirt, but my understanding is proxmox doesn't "do" libvirt, so I'm not sure what the qemu-kvm/proxmox equivalents would be.

In libvirt, the likely source would be the no-arp-spoofing and/or no-mac-spoofing filter templates. They both create rulesets in ebtables that (among other things) add drop rules for destination addresses that don't match the guest for inbound traffic. This sounds in effect like what you're trying to disable, but again, I'm not sure how that would translate via the "naked" kvm command you're looking for.

Unfortunately there doesn't seem to be much helpful information available on network filtering in general for proxmox, and this page from last month doesn't make it sound like it's available at all. Sorry I couldn't come up with anything more concrete, and if you do find the kvm option that does this please follow up back here as I'd love to know about it.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.