Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to have a VirtualBox virtual machine that can't get online. I want to be able to monitor all network traffic attempts from the Linux host.

So, if the virtual machine attempts to make a SYN out to a random IP (that it can't route to) the Linux host will be able to see this traffic with tcpdump running. I believe I will need to setup some type of forwarding rules with IPtables.

Has anyone accomplished this?

share|improve this question
add comment

1 Answer

INPUT DROP OUTPUT DROP FORWARD DROP

If desired you can add separate rules for your internal networks you want to allow.

All traffic is dropped on the monitoring PC

Then monitor using snort. snort should still be able to monitor the network since it operates more like tcpdump internally.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.