StandAlone - Monitor Nic Selection

[NeoLife-iT]

Version

2.4.60

Installation Method

Network installation on Ubuntu

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

96

Storage for /

500G

Storage for /nsm

400G

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I have man NiC on this Server. I wanted to use the nic below but it keep error out - see pictures...any idea?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Have you tried the following?

sudo touch /etc/NetworkManager/conf.d/10-globally-managed-devices.conf
sudo service network-manager restart

[NeoLife-iT]

Trying new install as MANAGERSEARCH node

[NeoLife-iT]

That install also work. so how do i add the monitor Nic to this install?

[NeoLife-iT]

[cm-ops]

Manager and Managersearch nodes don't monitor traffic. If you want to monitor network traffic and you are installing distributed you should choose sensor. https://docs.securityonion.net/en/2.4/architecture.html#distributed

[NeoLife-iT]

I did installed successfully once before on this same server. But recently I Added more RAM and Added Intel Nic with SFP and then re-install. It does not made sense why it is not working now. So I am going to remove the New NIC and run-install again soon.

[dougburks]

First, please note that network installations are not officially supported:
https://docs.securityonion.net/en/2.4/network-installation.html

If the network configuration portion displays a message like The IP being routed by Linux is not the IP address assigned to the management interface, then you have multiple network interfaces with IP addresses. In most cases, sniffing interfaces should not have IP addresses and there should only be an IP address on the management interface itself. Sometimes this is caused by a sniffing interface connected to a normal switch port (not a TAP/span port) and acquiring an IP address via DHCP. Double-check your network interfaces, wiring, and configuration.

[NeoLife-iT]

I might have mistaken on successfully install ubuntu + sOs on this physical server. I will remove the new Nic and try the install again.