1

I'm setting up an IDS using Security Onion on VMWare ESX. I have a VLAN from the (physical) switch which has the network SPAN port; this is feeding into the ESX virtual switch, and this port group is set to Promiscuous. Likewise, the second network interface on the VM is connected to this ESX portgroup and is also set to promiscuous (auto-configuration by Security Onion).

My problem is that no traffic is coming to Snort in any way that I can detect. SGUIL and ELSA have no logs; even a tcpdump on that port is showing nothing. I know there is traffic on the network, but I don't know where it is being lost.

Has anyone set up something similar? Was there any particular configuration needed?

Improve this question
3
  • The problem is likely in your Vswitch config. Can you post it?
    – Ron Trunk
    Mar 18, 2016 at 18:12
  • I've got the distributed switch config from the VMWare team: imgur.com/a/BLoyQ
    – Austin
    Mar 21, 2016 at 10:50
  • It looks increasingly likely that the feed from the initial SPAN on the physical switch is misconfigured. I'll update this once it's confirmed.
    – Austin
    Mar 22, 2016 at 15:24

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .