How do pass a network span port directly into KVM instance? (Netflow analyser)

[victorhooi]

Hi,

I'm trying to setup Elastiflow (Netflow traffic analyser) on a KVM instance.

That means I need to pass our WAN traffic into this instance.

I can setup a span port on our switch, and plug that into one of the secondary NICs on the ProxMox host.

However, how do I then pass this NIC directly into a given KVM instance?

Thanks,
Victor

 

[Alwin]

Either you can use a bridge (all traffic is forwarded) on the dedicated port or it should work by passing through the NIC as a PCI device.
https://pve.proxmox.com/wiki/Pci_pa...our_PCI_card_address.2C_and_configure_your_VM

 

[micush]

Netflow/SFlow/IPFIX do not require port mirroring. It's the entire point of the different protocols. Network devices deliver packet summaries to a destination IP address with an appropriate logging/parsing/presentation tool (ElastiFlow in this case).

 

[victorhooi]

Ah yes - but the Unifi switch range does not support Netflow.

That's why I figured the next best thing was to install nProbe, or vflow on a KVM instance, and connect a spanning or mirrored port into that instance.