Pre-Planning: General Questions

[Goudax64]

Detail

I'm in the planning phases and getting ready to purchase some hardware to setup SO on my home network. I have a few general questions.

My setup:
Router-on-a-stick config with pfSense sitting on a Cisco switch with many VLANs. Only layer 2 routing.

I looked at my average traffic over the last three months, which comes out to about 18MB/s. That number is somewhat skewed because I had a three day period where I setup a new file server and rsync'd data from the old one to the new server, hitting 544MB/s for most of those three days. That's the only time in memory that I've had such high traffic.

I'm planning to use a single appliance with a standalone config.

Questions:

1. Do I lose any real benefit if I capture all of the traffic from the main trunk port between the switch and router instead of a granular approach of each VLAN? Since it's router-on-a-stick, everything flows over one trunk port between the router and switch, which would be more simple and require less resources. Everything flowing across this trunk should be tagged.
2. I understand that TAPs are preferred for a few reasons. I would love one, but that may be down the line due to added cost. Given 18MB/s is the high-end of average traffic flow, and using an enterprise Cisco switch meant for much higher traffic loads, what is the likelihood of having performance issues such as packet loss or malformed packets?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

Do I lose any real benefit if I capture all of the traffic from the main trunk port between the switch and router instead of a granular approach of each VLAN? Since it's router-on-a-stick, everything flows over one trunk port between the router and switch, which would be more simple and require less resources. Everything flowing across this trunk should be tagged.

If the traffic flowing across the trunk has VLAN tags, then this should be fine for a homelab environment. Once you get everything up and running, go to SOC Dashboards, click the dropdown menu, and select the VLAN dashboard to see if it shows what you expect:
https://docs.securityonion.net/en/2.4/suricata.html#vlan-tags
https://docs.securityonion.net/en/2.4/zeek.html#vlan-tags

I understand that TAPs are preferred for a few reasons. I would love one, but that may be down the line due to added cost. Given 18MB/s is the high-end of average traffic flow, and using an enterprise Cisco switch meant for much higher traffic loads, what is the likelihood of having performance issues such as packet loss or malformed packets?

This should be fine for a homelab environment. You can use Zeek capture loss to see if you might be seeing any upstream packet loss in the Cisco switch:
https://docs.securityonion.net/en/2.4/zeek.html#packet-loss-and-capture-loss