How to add a static IP to sniffing interface

[borgoncete88]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64 Gb

Storage for /

65 Gb

Storage for /nsm

125 Gb

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all, I have configured my Security Onion with two interfaces. Management interface in ens192 with static IP and interface ens224 for sniffing. It was easy to set IP to management interface, but I would like to set a specific IP on sniffing interface. How could I do it? For now it was sniffing traffic but I cannot check how because I cannot see if there was a dinamic IP on that interface. Kind regards.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

Your monitor interface will not have an IP address. Rather it just collects all packets received via a TAP or span port. If you're looking to collect something like netflow data you would point it at your Security Onion management IP address and setup an Elastic Agent integration.

Here are supported Elastic Agent integrations https://docs.securityonion.net/en/2.4/elastic-fleet.html#integrations

[borgoncete88]

Hi @InfosecGoon,

That's exactly what I needed! but in my case for network 192.168.20.0/24. So I configured like this, hope it works:

[petiepooo]

@borgoncete88 there may be some confusion on how your monitor port is connected. It should not be a normal switchport in your networking gear, or all you will see is broadcast/multicast traffic. You need to set it up as a destination for a monitor session.

On Cisco gear, for example, you might follow these guidelines: https://community.cisco.com/t5/networking-knowledge-base/how-to-configure-port-monitoring-span-on-a-catalyst-2940-2950/ta-p/3132032

For consumer-grade devices, some have "Smart Managed" features that allow you to configure that via their GUI. Eg., my TP-Link TL-SG1016DE has an option for Port Mirror.

[borgoncete88]

Hi @petiepooo,

That's an aditional layer of setting I didn't know. In my case my Security Onion is a VM running on a VMware environment with a dedicated vSwitch with two interfaces, one for management and other for sniffing set as promiscuous mode. If I have to configure anything in my Aruba switch regarding this, it should be detailed on Security Onion documentation, and if it is, I did not noticed.

Thanks for your answer :)

[petiepooo]

No problem; glad to help. I'm over my head trying to help with vSwitch settings, though. I mostly live in the physical world still. :/

[petiepooo]

BTW, here's where the docs talk about it: https://docs.securityonion.net/en/2.3/hardware.html#packets

Every network is different, so there's not too much detail, and no mention of configuring vSwitches..