OpenVswitch – Port mirroring

I’m preparing a virtual laboratory for IDS and Honeypot testing that will be running on my OpenNebula private cloud. In the following diagram you can see that I want my IDS (sherlock) to inspect traffic from/to my Vyatta firewall so I’ll do that configuring port mirroring, thanks to openvswitch impressive functionalities. (I’ve used Dia for creating this diagram, what a great tool!).

My N40L server has only one physical ethernet interface (eth0) and I’ve already created an openvswitch bridge called br0 which is associated to eth0.

In OpenNebula I’ve configured one virtual network called inet which is assigned to br0. Watson (my vyatta router) and Sherlock (my OSSIM machine full of sensors) have one interface attached to inet/br0: vnet2 and vnet0 respectively.

#ovs-vsctl show
...
Bridge "br0"
    Port "vnet2"
        Interface "vnet2"
    Port "eth0"
        Interface "eth0"
    Port "vnet0"
        Interface "vnet0"
    Port "br0"
        Interface "br0"
          type: internal

OK. Now, according to ovs-vsctl man page, if I want the vnet2’s traffic to be mirrored onto vnet0 I’ll run this command:

#ovs-vsctl -- set Bridge br0 mirrors=@m \
 -- --id=@vnet0 get Port vnet0 \
 -- --id=@vnet2 get Port vnet2 \
 -- --id=@m create Mirror name=mymirror select-dst-port=@vnet0 select-src-port=@vnet0 output-port=@vnet2
b74eaf43-92ca-48f5-9fe6-9a561a9937dd // the mirror id

#ovs-vsctl list Bridge br0
_uuid : e3e03141-9754-489b-b4b8-17de2f063b44
controller : []
datapath_id : "0000009c029752bd"
datapath_type : ""
external_ids : {}
fail_mode : []
flood_vlans : []
flow_tables : {}
mirrors : [b74eaf43-92ca-48f5-9fe6-9a561a9937dd] // The mirror id is the one shown after the previous command<strong>
</strong>

I checked that as soon as the mirror was set, my tcpdump started showing traffic sent to my firewall so that’s what I exactly wanted 😀

If you want to stop the mirror you can use:

# ovs-vsctl clear Bridge br0 mirrors

Well, ovs-vsctl man page is full of info so if I find more interesting things I’ll let you know.

Advertisements