PCAP No data available on Fresh install in AWS

[spirrello]

I'm running a fresh install in AWS using the AMI from the Marketplace and am experiencing the same behavior mentioned here:
#9495

Details on my setup

• version 2.3.210
• Using AWS Traffic Mirror Session to send traffic to the mirroring NIC. I've confirmed this is working as expected.
• I'm using a Standalone, default install

From the main dashboard, if I select http, scroll down to the Events area and select PCAP from one of the entires, there is no data available ever for the PCAPs. I see this behavior for any event I try to use. I also experience this behavior when I select PCAP from the menu on the left and create a PCAP job. What is odd is that the status goes immediately to completed.

Here is what I've done

• I have tested the exact same setup with a vanilla Ubuntu 22.04 server using tcpdump to validate that we're seeing the intended traffic, no issues with this setup.
• I've confirmed captures are accumulating in /nsm/pcap
• Checked the stenographer logs:

sudo docker logs so-steno
Generating CA state
Generating key/cert for 'client'
Generating key/cert for 'server'
Skipping CA state generation, ca_cert.pem already exists
Skipping generation of 'client_127.0.0.1_client' key/cert, client_127.0.0.1_client_cert.pem already exists
Skipping generation of 'server_127.0.0.1' key/cert, server_127.0.0.1_cert.pem already exists

• Checked the status

sudo so-status

Checking Docker status

    Docker ------------------------------------------------------------------------------------------------------------------------------------------------------ [ OK ]

Checking container statuses

    so-aptcacherng ---------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-curator -------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-dockerregistry ------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-elastalert ----------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-elasticsearch -------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-filebeat ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-fleet ---------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-grafana -------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-idstools ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-influxdb ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-kibana --------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-kratos --------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-logstash ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-mysql ---------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-nginx ---------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-playbook ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-redis ---------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-sensoroni ------------------------------------------------------------------------------------------------------------------------------------------------ [ OK ]
    so-soc ------------------------------------------------------------------------------------------------------------------------------------------------------ [ OK ]
    so-soctopus ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-steno ---------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-strelka-backend ------------------------------------------------------------------------------------------------------------------------------------------ [ OK ]
    so-strelka-coordinator -------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-strelka-filestream --------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-strelka-frontend ----------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-strelka-gatekeeper --------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-strelka-manager ------------------------------------------------------------------------------------------------------------------------------------------ [ OK ]
    so-suricata ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-telegraf ------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-wazuh ---------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]
    so-zeek ----------------------------------------------------------------------------------------------------------------------------------------------------- [ OK ]

Additional logs
state_highstate_output.txt

sosetup.log

stenographer.log

[cm-ops]

Those logs all look fine. What is your PCAP retention at?

[spirrello]

@cm-ops It looks like I'm experiencing the same exact issue as reported here.

#1974

Is there a setting I can adjust for Zeek to automatically decapsulate VXLAN traffic?

[cm-ops]

Have you tried this? #8143

[spirrello]

I've chosen to just accept that the following Github issue will be the best solution. For the time being I'll be selecting a time frame without any other filters to generate the PCAP.

https://github.com/Security-Onion-Solutions/securityonion/issues/7985