Hi everyone, I am trying to run Snort (under CentOS) in a dom-U under XCP 1.6. I have set up a pif which is connected to a Cisco switch that is in mirror mode (SPAN port.) I have assigned a vif to the Snort dom-U that is connected to the SPAN port pif. If I run a tcpdump on the pif on dom-0, I see all traffic that is flowing through the network. If I run the same on the vif within the Snort dom-U, I don''t see that traffic. It seems to be that the openvswitch is filtering the traffic. I have set both the vif and pif to promiscuous mode but have not been successful in getting the SPAN traffic to pass to dom-U. Has anyone been successfully able to do this? Thanks, Ryan