packets dropped by kernel

[danielo37]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

293G

Storage for /nsm

924G

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello wonderful people,
I am working on a standalone configuration for pre production, installed SO in Hyper-V the only thing that I did in the hyper v config is set the monitoring interface to destination in Port Mirroring section in Advanced features, when I try to see if the interface receives anything from the virtual switch I get the following:

`[securityonion@srvpsocpro01 ~]$ sudo tcpdump -i eth1
[sudo] password for securityonion:
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C16:04:45.924796 IP6 fe80::479c:f669:73e7:abbd > ff02::1:ff4c:c2ab: ICMP6, neighbor solicitation, who has fe80::91ec:a50d:94c:c2ab, length 32

1 packet captured
3716 packets received by filter
3658 packets dropped by kernel`

it seems that it drops a lot of packets, I want to know how to solve the problem if anyone has any idea.

PS: the infrastructure has VLANs and I don't think that will be a problem for the packet capture AFAIK.

Thank you in advance.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

When I run tcpdump on my sensors, I get 0 packets dropped by kernel as expected.

Are you sure eth1 is the correct interface?

Is the interface in promiscuous mode?

What is the output of ip a?

[danielo37]

Yes it is eth1, and in promiscuous mode.
The following is the ip a resut:
[securityonion@srvpsocpro01 pcap]$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 00:15:5d:32:04:6b brd ff:ff:ff:ff:ff:ff inet 10.225.99.6/27 brd 10.225.99.31 scope global noprefixroute eth0 valid_lft forever preferred_lft forever inet6 fe80::215:5dff:fe32:46b/64 scope link noprefixroute valid_lft forever preferred_lft forever 3: eth1: <BROADCAST,NOARP,PROMISC,SLAVE,UP,LOWER_UP> mtu 9000 qdisc mq master bond0 state UP group default qlen 1000 link/ether 00:15:5d:32:04:6c brd ff:ff:ff:ff:ff:ff 5: bond0: <BROADCAST,MULTICAST,PROMISC,MASTER,UP,LOWER_UP> mtu 9000 qdisc noqueue state UP group default qlen 1000 link/ether 00:15:5d:32:04:6c brd ff:ff:ff:ff:ff:ff

[dougburks]

I don't have Hyper-V but you might want to check to see if there is anything else you need to configure on the Hyper-V side.