Deploying Security Onion / Proxmox Port mirroring

[Dazz]

Hi,

Im trying to mirror traffic from physical ethernet port to a Virtual Machine's virtual network card.

My setup is as following:

Proxmox

1. Physical interface enp3s0 ------> linuxbridge (vmbr0)
2. Physical interface enp4s0 ------> linuxbridge (vmbr1)

I added a new VM (Security Onion)

Assigned vmbr0 to VM (Security Onion)
Assigned vmbr1 to VM (Security Onion)


Configured vmbr0 within Security Onion as management interface
Configured vmbr1 within Security Onion as monitoring (capturing) interface (*connected the physical interface with the switch port where data is being mirrored)

The problem is that the traffic is not showing into the (Sguil,Elsa,Squert)

Is there any way to mirror traffic from physical network card to a virtual one ?

Thanks...

 

[Alwin]

The vmbrX interfaces are linux bridges and can't mirror traffic, you can configure it to act like a hub. As Proxmox has a debian 9 underneath, you can also use other linux tools, like tc, to achieve your goal.

 

[Dazz]

Hi Alwin,

How can i configure proxmox interface to act as a hub? I have never used tc before, can you help me on this ? Thank you for your response

 

[Alwin]

If you configure the bridge to be a hub, then all traffic going into that bridge will be forwarded to all connected ports on that bridge. So all VMs will see the same traffic. This is maybe not what you want.
https://techglimpse.com/convert-linux-bridge-hub-vm-interospection/

With tc you can controll where to forward mirrored traffic too.
http://lartc.org/manpages/tc.txt
https://www.systutorials.com/docs/linux/man/8-tc-mirred/

With those links provided, this is a very specific setup and may need some trail and error. There might be someone on the forum that has some experience with it.

For a easier setup, you have usually a gateway/firewall that the traffic passes through and that has either the tools for IDS/IPS on board or is capable of mirroring traffic.

 

[PssP]

I was looking to build something similar using traffic from a physical tap. I have been trying to figure how to get all traffic to my Suricata VM the last couple days. I have found a solution that might help you as well. My solution is exceedingly non-elegant, and likely isn't proper, but it works to some extent.

Current Configuration:
In my /etc/network/interfaces I have:

auto eno4
iface eno4 inet manual
    up link set $IFACE up
    up link set $IFACE promisc on

For the NIC itself where my tapped traffic comes in and:

auto vmbr8
iface vmbr8 inet manual
    bridge_ports eno4
    bridge_stp off
    bridge_fd 0
    bridge_ageing 0
    up ip link set $IFACE up
    up ip link set $IFACE promisc on

For the bridge to my monitoring VM.

This seems to work for the time being. I'm not sure if setting all the interfaces in promiscuous mode matters or not, but I don't feel like changing the file yet. I'm going to see if I can verify that packets aren't getting lost. Hopefully this helps!

 

[Charles Berghuis]

Hi Alwin, Thanks for the post. We are testing a VOIP Monitor and you suggestion to switch to a hub worked great.

 

[morph027]

I'm using daemonlogger as soft-tap to mirror traffic from one port/bridge to another sometimes.

 

[echo6]

Is it possible to setup a host only network for monitoring? I havent tried it but the config below should setup host only on vmbr1.

auto vmbr1
iface vmbr1 inet static
        bridge_ports none
        bridge_stop off
        bridge_fd 0

Which fails on a host because vmbr1 is not active

 

[James004]

I'm using daemonlogger as soft-tap to mirror traffic from one port/bridge to another sometimes.

Hi,
Do you have some explanation on how you are doing?

On my side, I've add a vmbr to my /etc/network/interfaces as follow:

auth vmbr3
iface vmbr3 inet manual
bridge_ports none
bridge_stp off
bridge_fd 0

Now, If doing "daemonlogger -i vmbr0 -o vmbr3", the answer is :
sniffing on interface vmbr0
ERROR: init_retrans() eth_open failed
Fatal Error, Quitting..

Any idea?

 

[morph027]

Huh, quite a long time ago i was using this. I'm not sure if i used the interfaces directly, not the bridge. So something like -i enoX (a slave of vmbr0) and -o tapXXXi0 (the interface of the VM)

 

[ncc321]

Huh, quite a long time ago i was using this. I'm not sure if i used the interfaces directly, not the bridge. So something like -i enoX (a slave of vmbr0) and -o tapXXXi0 (the interface of the VM)

FYI this still works just fine today on a fresh install.

-d daemonizes the process