Sensor node capturing from channel-interface?

[ejgh-oe]

Version

2.4.190

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

128GB

Storage for /

2T

Storage for /nsm

3T

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi,
I'd like to set up a sensor node capturing from two channeled 100GE-Interfaces via SPAN.

As a little background here's my setup: Firewall is connected to a local LAN-switch via 2x100GE interfaces forming a channel. The sensor node also has two 100GE-interfaces.

Is there a way (how?) sensor-side to configure the two 100GE-Interface to be in a "channel" and capturing traffic from that channel interface? Or is capturing only possible from physical interfaces?

Thanks much for any clue.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

By default the monitoring interfaces will be set with bond mode 0 during setup.

[ejgh-oe]

By default the monitoring interfaces will be set with bond mode 0 during setup.

Thanks alot - this will get me going.