Grafana Monitor interface shows no TX ?

[011248163264]

Hi i have a monitorinterface in grafana its the default dashboard and there are alot of trafik.
But i have maked a select with the same as RX like this:
SELECT non_negative_derivative(mean("bytes_sent"), 1s) *8 FROM "net" WHERE ("host" =~ /^$servername$/ AND "interface" =~ /^$monint$/) AND $timeFilter GROUP BY time($__interval), "host", "interface" fill(null)
but its nor working

this is the select from the rx, its working
SELECT non_negative_derivative(mean("bytes_recv"), 1s) *8 FROM "net" WHERE ("host" =~ /^$servername$/ AND "interface" =~ /^$monint$/) AND $timeFilter GROUP BY time($__interval), "host", "interface" fill(null)

The managment interface shows both rx and tx, so this is working.
But why is the monitor interface not working?
Is only the inbound trafik captured?

[InfosecGoon]

By default, the monitor interface is only receiving traffic in promiscuous mode and shouldn't be transmitting anything.

[TotieBash]

"$monint$" = Monitor Interface. Which is the sniffer bond ports. Which is rx only just like @InfosecGoon stated.
"$manint$" = Management Interface. I think this is what you are targeting for...

The default SO Grafana dashboard helps me out with all this Influxdb query. Specifically "Standalone" dashboard and "Security Onion Grid Overview".

[011248163264]

so there is no way to monitor in and outgoing internet in grafana ?

[TotieBash]

Absolutely there is. This is not a limitation of Grafana but the limititation of the "monitor" interface. I think there is a misunderstanding here so let me try to clarify

1. You can get TX and RX traffic on the management interface "$manint$".
2. You can NOT get TX but only RX on the "$monint$". By nature of the "monitor" interface it is receive only. Hence there are nothing in InfluxDB for Grafana to query since it is empty.
3. I assume you are trying to get TX from the "management" interface. Base on my assumption, you have a typo on your query. Change your query line from "$monint$" in to "$manint$".

[TotieBash]

"But why is the monitor interface not working?
Is only the inbound trafik captured?"

After reading it again I realize the misunderstanding is on my part. Apologize for the confusion.

Yes, the monitor interface is RX only in SO. Notice there is no IP address that you assign to the monitor interface since it is not necessary. Since there is no IP address the linux os does not even know how to use that monitor-interface to send traffic. Its only function in SO is to be be in promiscious-mode and to receive(RX) only. Typically the monitor interface is connected to a network tap. With the network tap TX is not possible at all.

[011248163264]

the managment is working tx and rx, the trafik comes from the main switch, the port on the mainswitch is mirrored from the main port.
the mirrored port goes to SO, the idea was monitor all trafik in and out in grafana, when this is not working i will check the trafik on the switch directly