I am new to this forum and I don't know if my post belongs in the right category. If not I am kindly asking a moderator to move it to the apropiate section.
Here goes my scenario.
I want to build an Intrusion Detection System using three Raspberry's Pi as monitors. The raspby's will have two NIC's with two different networks, one used for sniffing and one used for management.
I don't have the resources to have a complete lab and because of this, here comes into play virtualization.
I want to use one physical machine with four VM's and three subnets.
*three VM's as clients
*one VM as central server
I will have three subnets with one physical NIC connected to port 1 of a switch mirrored to span port 5. In span port 5 I connect another simple switch which has attached three Raspberry for sniffing.
The Raspberry's are intended to monitor/sniff the traffic between client and server.
Is this scenario possible ? If yes how? If not, whats the best approach to go with this?