NO ALERTS

[AB00-sys]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

12288

Storage for /

69.2

Storage for /nsm

133.7

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi everyone,

I need some help setting up Security Onion in VMware Workstation Pro for a project. I know this isn’t strictly a Security Onion issue, but I’m struggling with configuring the interfaces properly and could really use some guidance.

Here’s my setup:
1. Security Onion VM (2 interfaces):
• Management Interface: On NAT, has an IP.
• Sniffing Interface: On Host-Only.
2. Kali Linux VM: On NAT.
3. Metasploitable VM: On NAT.

All 3 VMs are on the same NAT subnet. My goal is for the sniffing interface in Security Onion to monitor traffic between the Kali and Metasploitable VMs (e.g., attack traffic) and generate alerts. Unfortunately, I’m not getting any alerts, and it seems the sniffing interface isn’t capturing the traffic.

Additional Details:

•	When I run sudo tcpdump on Security Onion, it listens to the management interface (ens160) and captures traffic.
•	However, when I manually specify the sniffing interface with sudo tcpdump -i ens192, it listens but shows no traffic.

This leads me to believe that it’s not a Security Onion problem but a misconfiguration in VMware or the network interfaces.

Main Issues:

•	The sniffing interface doesn’t seem to capture any traffic.
•	I’m unsure how to correctly configure the network interfaces in VMware Workstation Pro for this to work.

I know the issue is likely with the VMware networking configuration rather than Security Onion itself, but I’d greatly appreciate any advice or guidance on setting up the interfaces to enable proper traffic monitoring.

This is for a project, and I’m running out of time, any help would mean a lot!

Thank you in advance!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[eb-op]

Hey AB00-sys,

Have you tried putting the Kali and Metasploitable VM on a host-only network? If you need to, you can give a secondary NIC to the Kali box for NAT.
Hope this helps.

[AB00-sys]

Thanks, this really helped me.