So what could be the possibilities for this setup ? Is it possible to launch attack and detect it using single host machine?or it requires client-server type setup?

When you talk about launching an attack, do you mean outside your openstack environment? or do you have 2 separate instances(VM's) and you want one vm to attack another vm(running snort?)

I want to launch an attack from outside openstack environment to the private network that is set up in openstack and on the virtual machines that is deployed in it.Can we launch this attack from the host network itself? as i want to do it on a single host machine..

You might want to look at the link below and similar technologies. Forget about it being a "virtual machine" (VM) if you are hitting it from outside and simply treat it like another target system as each will have it's own virtual ports. Each VM can then be configured to log the same results, if comparisons are required, or differently, based on your purpose.

You may also use Kali or get involved with the Openstack security project (linked below).

https://www.owasp.org/index.php/OWASP_Web_Testing_Environment_Project

https://www.kali.org/

http://superuser.openstack.org/articles/openstack-security-spotlight/

Hi Priti,

If you are running a VM, so, it would be better to have two VMs, as snort will block whole that IP activity. That would be best practice for such condition.

Best,

I believe Priti Narwal is wanting to set up two VMs: one as attacker and the other as detector. This can be done as each machine has its own set of virtual ports. Installing Snort or other IDS on the host system would serve the primary physical Ethernet ports for the entire machine, I do not believe she is wanting to protect as much as observe.

Hi Omid,

yes i am running 2 VMs in openstack cloud but and i want to install SNORT on one of the VM but rather than launching attack from other VM ,i want to do the same from host machine network , as the private network in cloud and host machine network will be different. Not using virtual box instead i am running CENTOS 7 on the bare machine.

Hi William...Thanks for the information..i don't want one VM to be attacker and other as defender, instead i want only one VM for prevention and launch attack from external or host machine network. I have my VMs running on private network in openstack. So is it possible to have attack from same host machine?

Have a VM attack itself? Or have the host machine attack a VM? Both should be possible. You should be able to determine the IP address of the VM and run ping from the command prompt of the host machine. If that works, you can attack it the same way. The IP address must be publicly visible to be attack from outside the cluster.

For more information read below:

https://www.mirantis.com/blog/configuring-floating-ip-addresses-networking-openstack-public-private-clouds/

you can do it...keep it up..God blessing your research.

Yeap I have done the same. It can be done. I am also working on a better IDS for such distributed applications, which I will share once published.