Useless traffic on monitor interface

[n3rkel]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

300

Storage for /nsm

700

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi, I’m new to security onion. My bond0 interface is only collecting useless ARP, UDP, broadcast and IP who-has? data when I run tcpdump. I have tried changing the MTU value as an earlier discussion mentioned, but it didn’t work. Also, in SO > Grid, it shows Inbound Monitor Traffic:0.0 Mb/s & Dropped Monitor Traffic:0.0 Mb/s.
Here’s the output of some commands for help…

ens192              bd20565d-57a7-44a9-a90d-7d8a92f09fa6  ethernet  ens192
bond0               18750d1d-c089-4601-a5c2-b07a3c642506  bond      bond0
bond0-slave-ens224  5231dcea-468a-4d01-9f10-fbfee5149b8e  ethernet  ens224
docker0             330cf2ff-22c1-422e-b590-b09fa28e04a1  bridge    docker0
lo                  4ea03f11-0ffd-4208-9355-e751e0112b0d  loopback  lo
sobridge            dd9c5aa1-43f4-444e-8bc3-7cef4a0cdf62  bridge    sobridge
bond0               bb658004-a19c-4487-805b-a9b15a96e30e  bond      --
bond0               0abb1912-3ae7-40eb-bc00-104957710bc2  bond      --
ens224              721af9f2-27ad-4366-a96c-b4b4fc01e035  ethernet  --

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:0c:29:cf:75:eb brd ff:ff:ff:ff:ff:ff
    altname enp11s0
    inet 10.1.0.54/24 brd 10.1.0.255 scope global noprefixroute ens192
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fecf:75eb/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: ens224: <BROADCAST,NOARP,PROMISC,SLAVE,UP,LOWER_UP> mtu 9000 qdisc mq master bond0 state UP group default qlen 1000
    link/ether 00:0c:29:cf:75:f5 brd ff:ff:ff:ff:ff:ff
    altname enp19s0
4: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:0c:29:cf:75:f5 brd ff:ff:ff:ff:ff:ff

Could this be a SPAN misconfiguration? I don’t have access to the switch itself since my boss was the one who set it up. How can I check the configuration? What do I have to ask him? Maybe I can connect the ethernet cable from the SPAN port into a laptop to see… This is driving me crazy and i have 1 week until my internship ends lol.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[robbiemarshall]

You are correct in that it looks like an issue with your SPAN port configuration, as you're not seeing any traffic aside from the usual ARP and broadcast messages like you mentioned.