which method should I use to sniff packet

[sittipatwon]

I am kinda new user here, I do need to get packet form switch or router to my SecOnion Interface, And look like there way to do this,

1. Configure SPAN port at switch or
2. Configure Netflow at switch
   Can you suggest which one is the best?

[dougburks]

Netflow is not really the same as packet sniffing. For best results, we recommend sniffing traffic from a SPAN port or a dedicated TAP:
https://docs.securityonion.net/en/2.3/hardware.html#packets

[sittipatwon]

Due to this video , I found it is interesting, so I through it's another way to collect data and packet, Then plesae telll me what is the different between both of them.

[dougburks]

Notice that the video description says (emphasis added):

A walkthrough of how to ingest Netflow data in your Security Onion environment, for small or remote networks where you don't have a dedicated Security Onion forward node.

In other words, we highly recommend deploying Security Onion to sniff traffic from a SPAN port or a dedicated tap as mentioned above. If for some reason you can't do that, then as a last resort you might consider netflow instead.

What's the difference between netflow and sniffing from a span or tap? Netflow is just a very high level overview of your network traffic whereas consuming from a span or tap sees every single packet on the network.

As an analogy, think about the phone system. Netflow would just be a list of what numbers you called on your phone and how long those calls lasted. Whereas SPAN/tap would be like a wiretap where somebody else can actually listen to your conversation.

For more about netflow, please see https://en.wikipedia.org/wiki/NetFlow or search other Internet sites.

[sittipatwon]

Thank you, It was very valuable, Please tell me more about "What a dedicated TAP?" and "How to sniff traffic from a dedicated TAP?"

[dougburks]

A TAP is similar to a SPAN port but it's a dedicated piece of hardware separate from your existing network switches.

If you search our documentation for tap, you'll get several results:
https://docs.securityonion.net/en/2.3/search.html?q=tap

For more information about taps, please search the Internet using your favorite search engine.

[sittipatwon]

Thank a lot!