so-setup ignoring manual IP address input?

[richardm1]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16GB

Storage for /

65G

Storage for /nsm

124G

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi, I have an eval VM up and running after using the so-ip-update utility. The TUI setup seems to have ignored my manual IP address input.

From sosetup.log:

2025-06-29T08:32:38Z | INFO | Executing command: ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever

2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:c1:e0:9c brd ff:ff:ff:ff:ff:ff
altname enp11s0
inet 192.168.1.33/24 brd 192.168.1.255 scope global dynamic noprefixroute ens192
valid_lft 86389sec preferred_lft 86389sec
inet6 fe80::441e:6850:34bc:aab/64 scope link noprefixroute
valid_lft forever preferred_lft forever

3: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:0c:29:c1:e0:a6 brd ff:ff:ff:ff:ff:ff
altname enp19s0
inet 192.168.1.43/24 brd 192.168.1.255 scope global dynamic noprefixroute ens224
valid_lft 86389sec preferred_lft 86389sec
inet6 fe80::8568:e4a4:f321:7a11/64 scope link noprefixroute
valid_lft forever preferred_lft forever

192.168.1.33 on ens192 is a DHCP address. I had manually specified 192.168.1.80/24.

Shortly thereafter:

-----------------------------
Setting up the main interface
-----------------------------

Error: unknown connection 'ens192'.
Error: unknown connection 'ens192'.

Then a short while after that:

Install summary:
Security Onion Version: 2.4.160
Node Type: EVAL
Hostname: sonion
Network: STATIC
Management NIC: ens192
Management IP: 192.168.1.33

install_summary reflects the DHCP address; not the entered address.

I have a VM snapshot taken at the TUI's final confirmation step -- let me know if I should jump back to it and perhaps re-run the TUI with some kind of verbose logging/tracing enabled.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Is the interface set to use DHCP? What does this show? sudo nmcli dev show ens192