Snort in KVM machines

kvm-virtualizationsnort

I have installed two physical machines with KVM virtualization using Red hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 and in h2 the virtual machines w2 , db1 and ids. The virtual machine ids contain snort as IDS system. After the installation i ran the command:

brctl setageing br0 0

in order to permit snort sniff the network traffic but only is passing the traffic related with the physical machine h2 which is the Host the snort machine but nothing related with machine h1 and their virtual Guests.

Is possible with snort installed in a KVM virtual machine detect the traffic of the rest of machines in the network or only can detect the traffic of the machines sharing the same bridge?

thanks

Best Answer

The switch your two physical machines are plugged into will itself be learning what ports to send traffic down so it will have learnt that there's no point sending traffic destined for anything residing on host h1 down the port where host h2 is connected.

Look at configuring a span or mirror port on your switch, this allows you to configure a dedicated port that will receive copies of trafic on other marked ports (the ports connected to h1 & h2). You then need to attach that dedicated port to your ids VM.

Related Solutions

Can Snort be installed on VPS

Snort can be pretty memory hungry, which on a VPS may be a problem. It can run alongside ossec quite nicely - the two are both included in Ossim which correlates infosecurity events from various sources.

I'd argue that it is probably overkill for a single VPS though. If you keep all your software updated against any security releases, have good configuration settings, use tripwire and monitor logs then you're doing a really good job. And if you are protecting an entire network then I'd consider running ossim on a dedicated box.

If you're using Apache then consider mod_security to help protect potentially vulnerable scripts you are hosting. And finally be proactive in the security, scanning your box for vulnerabilities with something like Nessus.

Snort analysis of wireshark capture

I am not familiar with Gentoo specifically but you could try using the "--daq-list" flag to see what (if any) DAQ modules Snort sees.

e.g:

# snort --daq-list
Available DAQ modules:
pcap(v3): readback live multi unpriv
ipfw(v2): live inline multi unpriv
dump(v1): readback live inline multi unpriv
afpacket(v4): live inline multi unpriv

Then use the "--daq-dir " flag to point Snort to the directory containing the DAQ libraries.

snort -v -r jan21-for-snort.cap -c /etc/snort/snort.conf -l ~/snortlog/ --daq-dir /usr/local/lib/daq/

Best Answer

Related Solutions

Can Snort be installed on VPS

Snort analysis of wireshark capture

Related Topic