Re: Virtual Machines and Hypervisors

[Joel Esler <jesler () sourcefire com>]

On Jan 29, 2013, at 7:59 AM, Juan Camilo Valencia <juan.valencia () seguratec com co> wrote:

> Hi Guys,
>
> I am trying to find a way to ban virtual machines and hypervisors in our network, I made a quicly research and I 
> didn't found anything.
>
> Can somebody tell me if exist a way or a method to detect that, one of my ideas is when the VM is configured in NAT 
> mode detect that kind of traffic, but the problem is when the VM is configured in bridge mode.

It's a bit difficult to take care of this task via Snort as it involves tracking host vs. mac address vs. traffic.  
Snort doesn't help inherently with this.

Sourcefire makes another product that does this (it's not open source) in our commercial products.

--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!