View MAC address

[vaschthestampede]

I'm starting to use Security-Onion (2.4.130) and I wanted to ask you if, and if so how, it is possible to view, in addition to the IPs, also the MAC addresses, especially in the Alerts windows.

[TotieBash]

I double check zeek.conn log and the mac-address field is not there.. What is your use-case for wanting to see mac-address? You know depending on your placement of network taps you will not see the "actual" source/destination mac-address.. For example, typically you place a network tap at the egress choke section of your network between your router and firewall... With that you will only see the destination-mac of the next-hop firewall and source-mac of your router..

REF:
https://docs.zeek.org/en/master/logs/conn.html

[dougburks]

Also see the ARP section of the documentation:
https://docs.securityonion.net/en/2.4/arp.html

[vaschthestampede]

The ARP Visibility seems like an interesting concept but all the tests I do do not give the desired answer.

Or:

[dougburks]

Did you follow the steps in the documentation?

Did you go to your Zeek excluded configuration as shown in the Zeek configuration section, remove ecat_arp_info from the list, and save the configuration?

Did you wait 15 minutes for the configuration to take effect or force it immediately?

[vaschthestampede]

I did it in a wrong way, now it's working.

Now it would be convenient for me to have the hostnames too, should I create another thread?

[dougburks]

Now it would be convenient for me to have the hostnames too, should I create another thread?

Yes, please start a new discussion with appropriate title.

[TOoSmOotH]

The only reliable source for MAC Addresses would be the dhcp log.