andreas2 wrote on Tue, 08 September 2009 18:55 |
As I understood veth is a brigde, so all clients can listen to whole traffic.
|
From vzctl man page:
--mac_filter on|off
Enables/disables MAC address filtering for the Container veth
device and the possibility of configuring the MAC address of this
device from inside the Container. If the filtering is turned on:
* the veth device accepts only those packets that have a MAC
address in their headers corresponding to that of this device
(excluding all broadcast and multicast packets);
* it is impossible to modify the veth MAC address from inside the
Container.
By default, this functionality is enabled for all veth devices
existing inside the Container.