Packets not feeding back

[superjay007]

Hi all,

I'm trying to setup a new instance using Ubuntu, my sensors connect and I can see data on TCPDUMP. However my manager/search agent is not getting any information from the sensors, they show as connected in the GRID but I'm not seeing any network data.

I ran so-status on a sensor and it's all green, I've also run so-test and all is well.

For context as well, I initially ran this using the Sec onion image on Centos 7, which ran without issue. So I know it's not a vmware config issue.

[weslambert]

Are logs being written to /nsm/zeek/logs/current and/or /nsm/suricata?

If you perform the following on the search node, do you see any data inside of Elasticsearch (indices like so-zeek-*):

curl -sk https://localhost:9200/_cat/indices | sort -n