Xen users - May 2007 - Running snort on dom0

Hi all,

  I need to monitor all traffic and block bad requests on my guest machines and 
also on my xen host. To accomplish this I think to install snort on my dom0 host
(rhel5). Somebody have tried this? What about performance on guests??

Many thanks ...


-- 
CL Martinez
carlopmart {at} gmail {d0t} com

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

> I need to monitor all traffic and block bad requests on my guest
> machines and also on my xen host. To accomplish this I think to
> install snort on my dom0 host (rhel5). Somebody have
> tried this? What about performance on guests??
- work identical to fw,sniffer,net-acct...

  --- peth0  ---- eth0 ----- dom0
              |
              --- vif1.0 --- dom1

- snort read default from eth0
- would you scan complete traffic, bind snort to peth0
- would you scan dom1, bind snort to vif1.0

Torsten


--
Torsten lehmann
Launoc


_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users