View Monitoring Port Session in a virtual system

[mfinn]

I am looking to install an IDS system on as a Proxmox hosted virtual appliance. I have created the system and have added 2 network adapters. One for management purposes and the second to connect to a monitoring session on a switch. My problem is that for the connection I want to see the monitoring traffic on I cant get the required visibility in the Virtual system.

For the Proxmox server a tcpdump session on eth1 where the monitoring port is connected to I see the traffic I expect to see, a tcpdump on its related Bridge vmbr1 also shows me the traffic I want to see. However when I access the virtual machine and do a tcpdump on eth1 I am not seeing all the traffic. The configuration on the virtual machine in /etc/qemu-server/101.conf is

name: LANG8.5.1
ide2: local:iso/lg-8.5.1.iso,media=cdrom
vlan0: e1000=22:21:BA:E6:2E:73
bootdisk: ide0
ostype: other
ide0: local:101/vm-101-disk-1.raw
memory: 1000
sockets: 2
vlan1: e1000=E23:F9:3E:79:0C

Can this be done? Have I something missing in the bridging between physical server and virtual appliance?

Thanks for any help you can provide

Michael

 

[dietmar]

For the Proxmox server a tcpdump session on eth1 where the monitoring port is connected to I see the traffic I expect to see, a tcpdump on its related Bridge vmbr1 also shows me the traffic I want to see. However when I access the virtual machine and do a tcpdump on eth1 I am not seeing all the traffic. The configuration on the virtual machine in /etc/qemu-server/101.conf is

Really. We configure the vmtab using promiscuous mode, so you should get all traffic. What packets do you miss exactly?

 

[mfinn]

When running tcpdump on the interface in the virtual machine that is bridged to the physical interface that the monitoring session is connected to all I see is UDP broadcast traffic. I would expect to see TCP traffic but none is seen. The nature of the UDP traffic would suggest that only broadcast traffic is been passed from the bridge to the virtual machine interface.

 

[JimBeam]

Don't suppose this is supported or whether it works but you might try something similar to what I did:

Situation: WAN => eth0 card => proxmox host => eth1 card => LAN switch
I tried to prevent proxmox from listening on the eth0 interface and managed by not giving it or the vmbr0 bridge any ip address.
I then created a firewall vm (pfsense) and linked it to vmbr0 and vmbr1. It picked up the WAN DHCP server correctly.
Might be that the IP stack on the proxmox eth0 layer is doing something you don't want - then again I might be totally wrong....

My /etc/network/interfaces snippet for eth0/vmbr0:
iface eth0 inet manual

auto vmbr0
iface vmbr0 inet manual
bridge_ports eth0
bridge_stp off
bridge_fd 0