Promiscuous mode not working

[attinaibhayo]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16 core

RAM

64 GB

Storage for /

32 GB

Storage for /nsm

18 TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I dont know why, were using security onion 2.3 before which was running good and now have freshly installed the security onion 2.4.50. It was running for around 3 hours and suddenly the port where the promicious mode was configure was shutdown.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Can you expand on that some? Is it your bond0 interface that drops? If you run nmcli con show and ifconfig what do they show?

[attinaibhayo]

hi,
while running "nmcli con show" i got the folloiwng
NAME UUID TYPE DEVICE
ens4f0np0 c75e2ef6-551d-4373-ad33-8e1d0fb0db77 ethernet ens4f0np0
docker0 a45ff0c8-41e8-45d9-99fb-f14ed8903adb bridge docker0
lo b8f616fd-93ee-4cad-80d1-38f1de18ca45 loopback lo
sobridge 570835eb-4845-4eab-974c-96861e4a168e bridge sobridge
bond0 52aea234-2441-4fbe-8e01-2c1633726f0c bond bond0
bond0-slave-ens4f1np1 ac98c24f-c8d9-4dbf-b08d-55b5b63853e5 ethernet ens4f1np1
enp0s20f0u1u6 b577dd97-595e-4066-91c1-ec65a8d92dac ethernet --
ens4f1np1 9d4257aa-df85-4223-9f12-77c3fe018b6d ethernet --

I have done fresh iso installation, and it was working for like 24 hours, but now no traffic is shown in kibana. I am receiving traffic on promicous interface i.e. 26.5 GiB. i got this issue after the SO asking for reboot and i rebooted the server.My all services are running. Can you guide ma on this ?
ens4f0np0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.220.10 netmask 255.255.255.0 broadcast 192.168.220.255
ether 00:0a:f7:c8:29:d0 txqueuelen 1000 (Ethernet)
RX packets 648430 bytes 528351065 (503.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 67791 bytes 77720779 (74.1 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

ens4f1np1: flags=2499<UP,BROADCAST,RUNNING,NOARP,PROMISC,SLAVE> mtu 9000
ether 00:0a:f7:c8:29:d1 txqueuelen 1000 (Ethernet)
RX packets 35650534 bytes 28546465581 (26.5 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

[cm-ops]

ens4f1np1: flags=2499<UP,BROADCAST,RUNNING,NOARP,PROMISC,SLAVE> mtu 9000
ether 00:0a:f7:c8:29:d1 txqueuelen 1000 (Ethernet)
RX packets 35650534 bytes 28546465581 (26.5 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

I see that interface, but do you see a bond0 interface as well in ifconfig? I see it in nmcli above. If you sudo tcpdump -nni bond0 do you see traffic coming in?

[attinaibhayo]

Hi
I can see traffic on bond interface . Below traffic are captured.

59126 packets captured
180673 packets received by filter
119348 packets dropped by kernel

[attinaibhayo]

Hi,
Can anyone guide me on this how to troubleshoot the issue ?

[cm-ops]

Can you show an example of when the interface is down? What I see so far it looks like it is up. Do you see anything in dmesg or /var/log/messages ?

Have you looked into the Logstash log to see if there is an issue with the pipeline? /opt/so/log/logstash/logstash.log If you pipeline is not working you would also not see logs in the web console.