Hi folks,

I posted this question to the KVM list, but I thought I'd try here
too--sorry if this is the wrong place to post this, can you please
direct me to the correct forum or list if so, thanks!

I'm working on a network security project, using KVM installed on
CentOS 6.7 through yum. I have a VM with the goal of using this as a
network appliance, and two other VMs, one simulating an attack node
and the other simulating a vulnerable webapp. These are all connected
to the same internal private network set up in KVM. The idea with the
network appliance VM is to have it act as if it's connected to a
network tap so it can see the traffic between the other two VMs. I'm
not able to see the traffic currently and would appreciate your help
or suggestions to see if this is possible and how I can set this up if

so. I came across some information online suggesting to have the
interfaces in promiscuous mode, including the virtual NIC for the
private network, and I've tried all combinations. Thanks for any help
you can offer!