I have recently installed the Security Onion distro for Ubuntu.

This distro does a great job of combining multiple tools like snort/Suricata, Sguil, Snorby, Elsa, bro ids, Squert, etc. Within my Security Onion the installation interface has been port mirrored, but all the alerts I have seen show the source IP of our local network, both private and public.

I was able to see outside IPs in Elsa and squert pads data, but not in the Snorby alerts. This seems a little strange to me, as there has been a known DOS attempt with an outside IP. My BPF is also not stopping any outside IP either. I'm wondering if anyone could help me understand the possible reasons for such behavior?

The following are my BPF rules:

$ cat /etc/nsm/rules/bpf.conf

!(dst portrange 11000-65000) &&
!(src net &&
!(src net
!(src net 
  • I can probably answer this for you if you provide a small diagram and your IP scheme. Do you NAT both ways? Where is the sensor located in your architecture? – dc5553 May 12 '13 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.