Network Architecture SO

[nicholaswkc34]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

other (please provide detail below)

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

20GB

Storage for /

300

Storage for /nsm

300

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Dear Forumer, I need to configure tap for SO but I don't know how to connect the wire.
My network Diagram like this:

Modem -- OPNSense Firewall -- Linksys WIFI -- Endpoint (PC or Laptop or Phone)

I had purchased Throwing star Tap. There are total 4 ports one using for monitoring and another one for normal internet connection. Am i right?

How to use it?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

Please consult the documentation for the throwing star tap. It most likely has one monitoring interface for one side of the traffic and a second monitoring interface for the other side of the traffic. Because of this, you would need two sniffing interfaces (and a separate management interface) in your Security Onion sensor.

Due to this requirement for two sniffing interfaces and for other reasons, we generally recommend against throwing star taps and prefer single-port tap/span options as shown in the documentation:
https://docs.securityonion.net/en/2.4/hardware.html#packets