This howto describes how to configure a mirror port on your Open vSwitch. The goal is to install a new guest to act as IDS/IPS system. This guest is configured with 2 virtual network interfaces. The first interface will have an IP address and will be used to manage the guest. The other interfaces will be connected to the mirror port on Open vSwitch. This means that it will see all mirrored traffic.
My setup
Host OS : Ubuntu Quantal Quetzal 12.04 with libvirtd
Networking : The virtual machines are all connected to a OpenvSwitch bridge and are using RFC 1918 ip addresses. Since I only have a single external IP, my host runs a firewall that NATs certain ports towards the virtual machines.
XML configuration of guest
This is a copy of the interface declarations in the config file.
<interface type='bridge'> <mac address='52:54:bb:bb:11:11'/> <source bridge='ovsbr0'/> <virtualport type='openvswitch'> </virtualport> <model type='virtio'/> </interface> <interface type='bridge'> <mac address='52:54:bb:bb:11:12'/> <source bridge='ovsbr0'/> <virtualport type='openvswitch'> </virtualport> <model type='virtio'/> </interface>
Since the MAC address has to be unique, we can use that as an identifier to configure the mirror port on Open vSwitch.
Configuring the mirror port on Open vSwitch
This script should be named ‘qemu’ and should be placed in ‘/var/libvirt/hooks’.
#!/bin/bash # Written by Thomas Elsen # You can use this at your own risk. # # The following to variables should be set before using the script. # MAC containts the mac address from the interface that will receive # all mirrored traffic. MAC="52:54:bb:bb:11:12" #GUEST should point to the name of the guest GUEST="ids" if [ $1 = $GUEST ]; then if [ $2 = 'started' ]; then IFACE=`ifconfig | grep $MAC | awk '{print $1;}'` ovs-vsctl clear bridge ovsbr0 mirrors ovs-vsctl -- --id=@m create mirror name=mirror0 -- add bridge ovsbr0 mirrors @m -- --id=@capt get Port $IFACE -- set mirror mirror0 output_port=@capt select_all=1 exit 0 fi fi echo "Nothing to do : $1 $2" | logger exit 0
After installing the script, make sure to set the 2 variables to the right values and give it the right permissions.
# chmod 755 /etc/libvirt/hooks/qemu
Using the above script will make sure that the mirror port is created when the guest is started. To make sure that libvirtd will use this new script, we have to restart it.
# /etc/init.d/libvirt-bin restart
Next step
In the next article I’ll use this new guest to run snort. Snort is an Open Source IDS sensor.
Pingback: Howto install Snort | The A to Z of IT
Pingback: Xenserver, Open vSwitch, and port mirroring – James Timberlake