No packets are captured from a tap interface

[3freet]

Hello everyone,

I am trying to capture traffic from a local tap interface, but no packets are captured in the monitor interface (bond0). Here is an overview of my setup;

Security Onion 2.3.250-20230519 ISO fresh install.
My monitoring setup a bit unusual, I'm receiving mirrored traffic in a local tap interface that is connected to an openvpn tunnel, a sort of Remote SPAN (RSPAN).

I've chosen tap4 to be the monitor interface during setup.

It is working as expected when I capture traffic directly from the tap interface, I can see all mirrored traffic coming from the other end of the tunnel.

However, no packets are captured on the bond0 interface and no data show up in dashboards.

Here is the output of nmcli con show

Any hints on why this is the case?
Thanks!

[jrmsq]

I have had something Similar.
tap4 has to be on promiscuous mode for it to get you the data you are expecting.

If tap4 is your actual port it has to be setup like this:
Steps:
1. ifconfig tap4 promisc NOARP
2. ifdown tap4
3. sudo ip link set tap4 up arp on promisc
4. sudo ip link set tap4 up promisc on bond0
5. sudo ip link set tap4 master bond0
6. sudo systemctl restart network

Hopefully this works for you.

[3freet]

Unfortunately that did not work. but after digging further I found the solution below.
Thanks for the hints!

[3freet]

So the culprit was that the tap interface for some reason was not being added to the bond0 interface.

Checking via cat /proc/net/bonding/bond0

# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: load balancing (round-robin)
MII Status: down
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

And after simply typing the command ifenslave bond0 tap4 we see that the bond0 status is now up.

# ifenslave bond0 tap4
# cat /proc/net/bonding/bond0
Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)

Bonding Mode: load balancing (round-robin)
MII Status: up
MII Polling Interval (ms): 100
Up Delay (ms): 0
Down Delay (ms): 0

Slave Interface: tap4
MII Status: up
Speed: 10 Mbps
Duplex: full
Link Failure Count: 0
Permanent HW addr: a6:d7:0b:30:cf:3b
Slave queue ID: 0

And now we can capture raw packets on the bond0 interface.
And for my use case I had to add the following lines in openvpn config file to add the tap4 interface to the bond whenever openvpn reconnects

script-security 2
up "/usr/share/scripts/ifenslave.sh"

The file ifenslave.sh content is:

# cat /usr/share/scripts/ifenslave.sh
#!/bin/bash

/sbin/ifenslave bond0 tap4