I'd like to set up two different systems that will monitor network traffic, but have only one monitor/mirror port available on our central switch. I was hoping that I could install both systems as separate domains on the same kvm box, and configure each to listen on the network adapter connected to the monitor/mirror port on the switch.
Does anyone know if it's possible to have 2 VMs share the same NIC in promiscuous mode such that each can sniff traffic on the network? Would I be better off connecting the monitor port to a hub (not a switch) to duplicate the traffic?
Update: I actually ended up going with KVM rather than Xen, but this does seem to work as the interfaces are bridged in promiscuous mode, so each domain sees all the traffic on that interface.
There are also specialized tap splitter devices whose sole purpose is to split and mirror traffic. They're not cheap, but it's another option.