Monitor the traffic to qemu

Zeek
1

Hello,

I have Ubuntu installed as a host system with Debian running as the guest system on qemu. I need to send created traffic from the host to an Apache web server installed on the guest and monitor this traffic using bro which is installed on the host.
What is the best way to make this connection? I would really appreciate if you could provide me with a link or something on how to make the bridge. I have tried several ways but haven’t been successful yet!

Thank you so much in advance,
Mahboobeh

2

Hi,

Hello,

I have Ubuntu installed as a host system with Debian running as the
guest system on qemu. I need to send created traffic from the host to an
Apache web server installed on the guest and monitor this traffic using
bro which is installed on the host.
What is the best way to make this connection? I would really appreciate
if you could provide me with a link or something on how to make
the bridge. I have tried several ways but haven't been successful yet!

I think you could just tap bro to the virtual ethernet interface of your
VM, I'm not very familiar with using only QEMU but I think the
networking section in their documentation should help you. There is also
a monitoring subsection.

http://wiki.qemu.org/Documentation/Networking

Best regards

Christian

3

Openvswitch has port mirroring capability if you would like to go that route on your VM host:

http://git.openvswitch.org/cgi-bin/gitweb.cgi?p=openvswitch;a=blob_plain;f=FAQ;hb=HEAD