Xen users - Sep 2008 - R: Re: bridge and tcpdump

>If you listen on dom1 and the ping dom3 from dom2 then you mustn''t
see
>that traffic, because xen networking is not based on virtual hubs (which
>simly relay every packet to every port), but it''s based on virtual
>switches, 
and switches intelligently forward the packets, only for
the
>recipient. In 
this case dom1 is neither the sender nor the recipient.
>Try to listen on dom2 
(e.g. with "tcpdump -n -i eth0") and then ping
>dom2 from dom3. Now you should 
really see something.

is possible capture the traffic in the same mode we can 
sniffing a LAN?

if the bridge can''t capable, in other way is possible?

thanks

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

On Wed, Sep 17, 2008 at 11:46 AM, rmarfisi@inwind.it <rmarfisi@inwind.it>
wrote:
> is possible capture the traffic in the same mode we can
> sniffing a LAN?
even on a real LAN, if your sniffer is on a switch, you won''t see any
traffic not intended for you.

most programmable switches let you set a ''monitor'' port, that
gets
copies of other port(s) at the cost of performance (in the extreme
case, if you want to monitor all ports, performance becomes equivalent
to a hub)
> if the bridge can''t capable, in other way is possible?
from Dom0 you can watch on the bridge itself.  i think that would show
all traffic.

also, you can watch on the virtual interface associated to a DomU, and
it will show all traffic to/from that DomU, from ''outside''

there are some userlevel tools that emulates a switch or a hub,
replacing the bridge on Dom0 with one of those tools (i think UML
includes one) might let you establish a ''monitor'' DomU


-- 
Javier

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users