port_mirror.sh

#!/bin/bash
# Port mirroring script for XenServer and Security Onion
# Author: https://reddit.com/u/Brave_Little_Roaster

# Set this to the interface on XenServer that recieves mirrored traffic
MON="eth1"
# Set this to the XenBridge that VMs will use to recieve mirrored traffic
XBR="xenbr1"

# Gets the DOM-ID of the Security Onion VM. Needed for finding the virtual interface name (vif)
ID="$(xe vm-list name-label=<nameLabelOfVM> params=dom-id | cut -d':' -f2 | grep [0-9] | cut -d' ' -f2)"
DOM_ID=$ID.0

# Set our physical interface and XenBridge to promisc mode. 
ifconfig $MON promisc
ifconfig $XBR promisc

# Set port mirroring of physical interface to Security Onion XenBridge. 
ovs-vsctl -- set Bridge $XBR mirrors=@m \
-- --id=@$MON get Port $MON \
-- --id=@vif$DOM_ID get Port vif$DOM_ID \
-- --id=@m create Mirror name=$MON-mirror select-dst-port=@$MON \
select-src-port=@$MON output-port=@vif$DOM_ID