No data in console from pcap import #14557

RailsGuy · 2025-04-21T12:52:42Z

RailsGuy
Apr 21, 2025

Hi there, I'm new to SO and have an "import" install of Version: 2.4.141. Installed on ESXi from the iso. I have attempted to import a pcap file but not seeing any results in the console. Have I done something wrong or could there be a problem with my install?

# Captured the pcap with
sudo tcpdump -i ens224 -w /tmp/tcpd_test.pcap 
 
# Import on SO

 sudo so-import-pcap tcpd_test.pcap
 Processing Import: /home/{MYSO}/tcpd_test.pcap
 - verifying file
 - assigning unique identifier to import: b2481ba090bc7951689fa6b4f2821cb5
 - analyzing traffic with Suricata
 - analyzing traffic with Zeek
 - found PCAP data spanning dates 2025-04-21 through 2025-04-21

 Import complete!

 Use the following hyperlink to view the imported data. Triple-click to quickly highlight the entire hyperlink and then copy it into a browser:
 https://{MYSOIP}/#/dashboards?q=import.id:b2481ba090bc7951689fa6b4f2821cb5%20%7C%20groupby%20event.module*%20%7C%20groupby%20-sankey%20event.module*%20event.dataset%20%7C%20groupby%20event.dataset%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port%20%7C%20groupby%20network.protocol%20%7C%20groupby%20rule.name%20rule.category%20event.severity_label%20%7C%20groupby%20dns.query.name%20%7C%20groupby%20file.mime_type%20%7C%20groupby%20http.virtual_host%20http.uri%20%7C%20groupby%20notice.note%20notice.message%20notice.sub_message%20%7C%20groupby%20ssl.server_name%20%7C%20groupby%20source_geo.organization_name%20source.geo.country_name%20%7C%20groupby%20destination_geo.organization_name%20destination.geo.country_name&t=2025%2F04%2F21%2000%3A00%3A00%20AM%20-%202025%2F04%2F22%2000%3A00%3A00%20AM&z=UTC

 or, manually set the Time Range to be (in UTC):
 From: 2025-04-21    To: 2025-04-22

 Note: It can take 30 seconds or more for events to appear in Security Onion Console.

# import files
ls -l  /nsm/import/b2481ba090bc7951689fa6b4f2821cb5/suricata/
total 64
-rw-r--r--. 1 suricata suricata 63476 Apr 21 12:19 eve-2025-04-21-12:19.json
-rwxr-xr-x. 1 root     root         0 Apr 21 12:19 suripcap

 ls -l  /nsm/import/b2481ba090bc7951689fa6b4f2821cb5/zeek/logs/
total 2068
-rw-r--r--. 1 root root     109 Apr 21 12:19 capture_loss.log
-rw-r--r--. 1 root root  218596 Apr 21 12:19 conn.log
-rw-r--r--. 1 root root     197 Apr 21 12:19 console.log
-rw-r--r--. 1 root root   84963 Apr 21 12:19 dns.log
-rw-r--r--. 1 root root   13573 Apr 21 12:19 ecat_arp_info.log
-rw-r--r--. 1 root root    3761 Apr 21 12:19 files.log
-rw-r--r--. 1 root root    3634 Apr 21 12:19 http.log
-rw-r--r--. 1 root root     339 Apr 21 12:19 known_certs.log
-rw-r--r--. 1 root root     804 Apr 21 12:19 known_hosts.log
-rw-r--r--. 1 root root    2583 Apr 21 12:19 known_services.log
-rw-r--r--. 1 root root   48032 Apr 21 12:19 loaded_scripts.log
-rw-r--r--. 1 root root 1622351 Apr 21 12:19 mysql.log
-rw-r--r--. 1 root root    1207 Apr 21 12:19 notice.log
-rw-r--r--. 1 root root   24535 Apr 21 12:19 ntp.log
-rw-r--r--. 1 root root      90 Apr 21 12:19 packet_filter.log
-rw-r--r--. 1 root root     249 Apr 21 12:19 reporter.log
-rw-r--r--. 1 root root     598 Apr 21 12:19 software.log
-rw-r--r--. 1 root root   14086 Apr 21 12:19 ssh.log
-rw-r--r--. 1 root root   25936 Apr 21 12:19 ssl.log
-rw-r--r--. 1 root root    1348 Apr 21 12:19 x509.log


# status
 sudo so-status

                        Security Onion Status                        
                         Container │ Status  │               Details 
───────────────────────────────────┼─────────┼───────────────────────
                 so-dockerregistry │ running │           Up 17 hours 
                  so-elastic-fleet │ running │           Up 17 hours 
 so-elastic-fleet-package-registry │ running │ Up 17 hours (healthy) 
                  so-elasticsearch │ running │           Up 17 hours 
                       so-idstools │ running │           Up 17 hours 
                       so-influxdb │ running │ Up 17 hours (healthy) 
                         so-kibana │ running │           Up 17 hours 
                         so-kratos │ running │           Up 17 hours 
                          so-nginx │ running │ Up 17 hours (healthy) 
                      so-sensoroni │ running │           Up 17 hours 
                            so-soc │ running │           Up 17 hours 
                       so-telegraf │ running │           Up 17 hours 

 ✔ This onion is ready to make your adversaries cry!