All networks same bridge, man in the middle attack?

[TheNoob]

If you have all your VMs on the same bridge (vmbr0) with different IP Addresses assigned can a man in the middle attack be performed to see what data is being sent throughout the entire network?

 

[gmed]

Bridges act like a Switch not a dump Network-Hub.
As long as the bridge ageing isn't set to 0 it's not that easy to get onto the traffic.
Especcially for the VM's wich are connected with their own tun-Device to the bridge.

On the other hand, one could monitor traffic of a VM with connecting to its tun-Device.
But one has to sit on the host, not within a VM.

 

[spirit]

if you use same bridge, you can do mac address/ip address spoofing man-in-middle.
you can use proxmox firewall mac address / ip filters to prevent this.