#SECURITY ONION NTOPNG STOPS VM NIC MAC#

Verify everything turned out alright with: Then press ESC and type !wq and hit enter to exit vi. */10 * * * * /etc/startup_scripts/port_mirror.sh

It opens a vi window, so press the INSERT key and paste this line: In the terminal at XenCenter run these commands: Set a crontab job to run it every 10 minutes. It won't hurt anything to have it run here and there. So if the VM decides to restart itself for whatever reason, or if you trip over the power cable to your server rack while trying to get the Halloween decorations out, then you'll need to log in and rerun all these damn scripts. With these incrementing, that means we'd have to runt he port_mirror.sh script every time this restarts. 14: We can see the domain ID has incremented. For example, I'll restart my Security Onion VM.įig. It works, but there's a problem! Those of us intimately familiar with XenServer will know it increments the domain ID every time that VM is restarted. 13: Now you can see your roommates or SOs porn browsing habits! Yay! It will then instruct to mirror the traffic.Īfter making your changes to the script, run it, and let's test it out by pinging the gateway again from another machine.įig. It will then set this interface to point the traffic to the domain ID of your VM. It will first select the bridge, then create a mirror for the monitor interface.

Super important if you're cloning the traffic on your entire network and sending copies of it to 1 specific interface.

#SECURITY ONION NTOPNG STOPS VM NIC MAC#

Lines 15 & 16 will set those interfaces to promiscuous mode, which will allow it to receive traffic that isn't destined to reach your MAC or IP without dropping it. So, you will wanted to edit line 12 of the script to represent the interface number you configured security onion to listen on For example: $DOM.0 for eth0, $DOM.1 for eth1 So I need to be sending traffic to vif11.0 Well that's the actual interface number of your VM! For example, my VM listens on eth0. But what about the '.number' you see tagged on the end of the vif? 12: The current domain id of my Security Onion VM. Instead you can list the domain ID of each VM with this command:įig. But if you're running dozens of VMs, each with 2~4 interfaces, you're going to have a ridiculous amount of interfaces to comb through. It might be easy to figure out at a glance which VIFs belong to which VM. These 'vif', or virtual interfaces, are the actual interfaces of the VM. On your Xen Server host, run ifconfig, and look for an interface named 'vif' If you have no idea what I'm talking about or what it is, I'll explain it real quick. The command 11 returns a numerical value that is then used to identify the domain ID of your virtual interface. It is the virtual interface label for your VM. This will be the value passed to the ovs-vsctl command. If you don't know what it is, run the command:Īnd find the name-label value there that you set for your VM when you built it. You will have to edit this to match your name-label. On line 11, we query the server for the Security Onion name.

Security onion ntopng stops vm nic