I received a report that vif-bridge adds any tap interface to a bridge, regardless if xen is running and who created the tap interface. E.g. # tunctl -p -t tap42 will cause vif-bridge to be executed as per the following rule in xen-backend.rules SUBSYSTEM=="net", KERNEL=="tap*", ACTION=="add", RUN+="/etc/xen/scripts/vif-setup $env{ACTION} type_if=tap" I'm not sure how to improve the rule to prevent execution of vif-setup in this case. But it seems better to handle it in vif-bridge anyhow, by not connecting the interface to a bridge if there is no corresponding info in xenstore. Something along the lines of the attached quick patch. Comments? Thanks! Jim