I have recently installed the Security Onion distro for Ubuntu.
This distro does a great job of combining multiple tools like snort/suricata, sguil, snorby, elsa, bro ids, squert, etc. Within my Security Onion the installation interface has been port mirrored, but all the alerts I have seen show the source IP of our local network, both private and public.
I was able to see outside IPs in elsa and squert pads data, but not in the snorby alerts. This seems a little strange to me, as there has been a known DoS attempt with an outside IP. My BPF is also not stopping any outside IP either. I'm wondering if anyone could help me understand the possible reasons for such behavior?
The following are my BPF rules:
$ cat /etc/nsm/rules/bpf.conf !(dst portrange 11000-65000) && !(src net 10.20.30.0/23) && !(src net 188.8.131.52)&& !(src net 184.108.40.206)