Security-Onion-Solutions / security-onion

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
https://securityonion.net
3.07k stars 522 forks source link

Unable to monitor Cisco Nexus traffic #1068

Closed chppppp closed 7 years ago

chppppp commented 7 years ago

I am running SO on a VBox VM from a Windows host and I am spanning layer 2 traffic from a Cisco Nexus 9396 to a dedicated sniffer interface on the host.

SO does not detect anything coming in. tcpdump on the interface shows plenty of traffic but it is all seen as "Ethertype Unknown"

18:27:29.887139 64:00:f1:27:f8:9e > 00:00:0c:9f:f0:65, ethertype Unknown (0x8926), length 202: 0x0000: 0000 0014 8100 0065 0800 4500 00b2 4014 .......e..E...@. 0x0010: 4000 7f06 611e 0a48 fb70 0a4b 4a10 e484 @...a..H.p.KJ... 0x0020: 01bd d773 e8e2 f4f6 341d 5018 0202 bdf5 ...s....4.P..... 0x0030: 0000 0000 0086 fe53 4d42 4000 0100 0000 .......SMB@..... 0x0040: 0000 0500 0100 0000 0000 0000 0000 bbf8 ................ 0x0050: 0300 0000 0000 fffe 0000 0100 0000 3500 ..............5. 0x0060: 00e4 2f8c 0000 0000 0000 0000 0000 0000 ../............. 0x0070: 0000 0000 0000 3900 0000 0200 0000 0000 ......9......... 0x0080: 0000 0000 0000 0000 0000 0000 0000 9f01 ................ 0x0090: 1200 0000 0000 0700 0000 0100 0000 4000 ..............@. 0x00a0: 4000 7800 0e00 0000 0000 0000 0000 7300 @.x...........s. 0x00b0: 7000 6f00 6f00 6c00 7300 7300 p.o.o.l.s.s. 18:27:29.887143 64:00:f1:27:f8:9e > 00:00:0c:9f:f0:65, ethertype Unknown (0x8926), length 1378: 0x0000: 0000 0014 8100 0065 0800 4500 054a 353c .......e..E..J5< 0x0010: 4000 7f06 b864 0a4d fc61 0a4b f813 d322 @....d.M.a.K..." 0x0020: 01bd 3238 db41 2857 82d4 5010 00ff 7468 ..28.A(W..P...th 0x0030: 0000 a76e fa4a 33d4 6eec adda fde7 4ded ...n.J3.n.....M. 0x0040: cf5b 5aa1 7b45 f2db 50db a18b 0665 d40e .[Z.{E..P....e.. 0x0050: 987e fc98 bbe2 01d3 6f0c 72c3 acb1 e7c0 .~......o.r..... 0x0060: 5cfd 41f1 11c1 6daf eca6 2f77 c0ed 84c9 .A...m.../w.... 0x0070: e204 b71d ab57 03bf c664 dc76 4c3a 15b7 .....W...d.vL:.. 0x0080: 1dba 694e 0e76 3736 d9ed 85d9 0861 b763 ..iN.v76.....a.c 0x0090: d230 ec1e 21ec 1e21 ec1e 21ec 7668 c76e .0..!..!..!.vh.n 0x00a0: f264 8ed8 dd79 35cf 4914 edf6 d41b e913 .d...y5.I....... 0x00b0: ec76 e887 e7af 262c c9ed 8545 b91b 7b2b .v....&,...E..{+ 0x00c0: 77ff 7957 6eaf 487e 1a72 3b64 5307 b903 w.yWn.H~.r;dS... 0x00d0: 96e4 0e58 92bb b135 2e9a f443 e01e 10e4 ...X...5...C.... 0x00e0: f6ca a2dc 090b 723b 5657 f060 b773 d2ab ......r;VW..s.. 0x00f0: d8ed 50b4 bbb1 c96e 2fcc 8608 bb1d 9386 ..P....n/....... 0x0100: 61f7 0861 f708 61f7 0861 b743 efed 3e1d a..a..a..a.C..>. 0x0110: 4c6c fbc9 ef6f c037 e4fb 9ea6 0655 8ec7 Ll...o.7.....U.. 0x0120: 4bf0 ccc9 c177 85ef c005 c303 55b5 ca8e K....w......U... 0x0130: abe2 f7c6 b5e2 faf7 bfac bf3f d7e6 375d ...........?..7] 0x0140: 02d7 da3c 54a5 1b8a 923c 50d5 2071 a02c ...<T....<P..q., 0x0150: 0f9c 06fa 8ae0 8992 954e 05f0 8d5a 8e87 .........N...Z.. 0x0160: 3be1 1352 8e87 baae 778d 9315 c133 27f3 ;..R....w....3'. 0x0170: bf42 78e0 d2bd f080 4959 25f9 0c55 00df .Bx.....IY%..U.. 0x0180: a041 f150 940f 5039 1e38 6957 393e 43e5 .A.P..P9.8iW9>C. 0x0190: f80c 95e3 3354 8e07 68c7 f152 f148 043f ....3T..h..R.H.? 0x01a0: c17f 775c 265a adcf 37e4 d571 7d92 03c7 ..w\&Z..7..q}... 0x01b0: bba8 efdc 496f 23a1 b863 49f1 409d 75ff ....Io#..cI.@.u. 0x01c0: 89e2 cd6d 8a3f aee1 8be2 4f66 d3fc 544f ...m.?....Of..TO 0x01d0: a4bd 2e29 d1dc ab4b 9a3b 75d7 47bb b0dc ...)...K.;u.G... 0x01e0: b164 b953 e98c 6d2b 6c69 aed9 6815 ca27 .d.S..m+li..h..' 0x01f0: 04cd bdb2 faa0 b85c a0d0 3c71 7a64 81e6 .......\..<qzd.. 0x0200: ced9 2342 b552 4fd8 6bdf a379 28eb 1542 ..#B.RO.k..y(..B 0x0210: f386 26cd bd28 1b20 2c77 2c58 3e42 583e ..&..(..,w,X>BX> 0x0220: 4258 3e42 58ee d08e e5e4 c71c 58a7 9f3a BX>BX.......X..: 0x0230: 9f66 4d22 fdb8 1596 7bca 4d05 0231 05cb .fM"....{.M..1.. 0x0240: 9dbb eb67 89b0 dcb1 90a1 1ea8 bbbe 1e17 ...g............ 0x0250: c9bb b096 bc12 e75f 6707 81bc 81e7 62fd ......._g.....b. 0x0260: 536f 9763 b837 2819 eed4 55ef 3861 b863 So.c.7(...U.8a.c 0x0270: c970 a7c2 8bd3 9f85 adc1 f921 7311 c3bb .p.........!s... 0x0280: a485 e8f8 61b8 5776 d7f5 0c82 274c 16e1 ....a.Wv....'L.. 0x0290: f8ed d845 c70f bf1d 93c6 e3b7 4377 fd44 ...E........Cw.D 0x02a0: 0486 3736 19ee 85d9 0061 b863 d230 e2f8 ..76.....a.c.0.. 0x02b0: 0861 f808 61f8 0861 b843 dfb2 415f 9f26 .a..a..a.C..A_.& 0x02c0: bd9e c88f 3962 78e7 d3bc 9d21 18ee 2937 ....9bx....!..)7 0x02d0: d227 e8ed 505d 0664 5180 dfce a528 ee54 .'..P].dQ....(.T 0x02e0: 3d3c 2fdb 0304 6fee dd5e 7cfb f35a a76b =</...o..^|..Z.k 0x02f0: 2e39 7a7b 4df2 e358 a63b 6497 38ec 762c .9z{M..X.;d.8.v, 0x0300: 9da1 072c 7da4 f059 dc1a 1af5 08bf bbc6 ...,}..Y........ 0x0310: b708 7e87 467d dd65 0785 e091 93bd 1186 ..~.F}.e........ 0x0320: 3bf7 d071 c670 c7a4 5f31 7c84 f0bb a1c9 ;..q.p.._1|..... 0x0330: 6f2f ca86 08bf 1d93 66e1 f708 e1f7 08e1 o/......f....... 0x0340: f708 e1b7 433b 119c b498 237e 771a cd9a ....C;....#~w... 0x0350: 211a 01f0 db33 6da4 4ff0 dba1 4ad1 790d !....3m.O...J.y. 0x0360: a8e8 ed58 d23b 5027 3d48 46ef e6de eadd ...X.;P'=HF..... 0x0370: 7f7e 46ef ab7e 0503 bdbd 26f9 6de8 edd0 .~F..~....&.m... 0x0380: 5557 13e8 ed58 d43b 60e1 a86d 2b6d 1b98 UW...X.;..m+m.. 0x0390: 93bd 2c16 bbbb a4b7 0876 7b65 f53c 46b0 ..,......v{e.<F. 0x03a0: 3b72 c16e e7d2 497a a856 ba15 bbbd ac6a ;r.n..Iz.V.....j 0x03b0: 9bec 1d10 bcb9 4970 2fcd 0609 c11d 9396 ......Ip/....... 0x03c0: 21f8 0821 f808 21f8 0821 b843 3b82 931a !..!..!..!.C;... 0x03d0: 7344 f04e a5d9 15dc b36d 2a36 cbe2 0dc7 sD.N.....m6.... 0x03e0: 2327 5117 c99d 4b92 3b75 baea 83e7 48de #'Q...K.;u....H. 0x03f0: 5c4b feb8 dc3f f4b5 52ac d39b 7906 f2fa \K...?..R...y... 0x0400: 7ef3 eb95 07d3 bdba b44e 77ca de2a 82ea ~........Nw.... 0x0410: 8ea5 757a a0e4 92c8 795b 536b 80f4 3a87 ..uz....y[Sk..:. 0x0420: e803 82e8 5e57 f5a6 8c21 613c 7232 8684 ....^W...!a<r2.. 0x0430: 71e7 a2e8 8e89 4e88 3e42 58de d064 b917 q.....N.>BX..d.. 0x0440: 65e3 83e5 8e49 b3b0 7c84 b07c 84b0 7c84 e....I..|..|..|. 0x0450: b0dc a11d cbab 1f0e 590e 3f1c b735 52c7 ........Y.?..5R. 0x0460: 012b df40 fa04 c51d aa4b 81c4 0b14 772e .+.@.....K....w. 0x0470: 29ee 54fa d6f0 b3b4 b771 bc8b d9ec 3e85 ).T......q....>. 0x0480: 6f0d 3f4b d8f9 71c4 f1d8 1cb9 5460 b773 o.?K..q.....T.s 0x0490: 3190 3ba6 8fcc a077 534f bd4f 2165 7542 1.;....wSO.O!euB 0x04a0: d0db eb4a df1a 7ec3 c965 00bd bdbc a8b7 ...J..~..e...... 0x04b0: 6332 67d0 7b84 d0bb a1fa 77cd 3ecd 32fa c2g.{.....w.>.2. 0x04c0: dba2 5e86 317c 6bf8 59da 0bf7 7ac5 c7ef ..^.1|k.Y...z... 0x04d0: b15d f83d 42f8 3d42 f8ed d08e dfe4 c61c .].=B.=B........ 0x04e0: 89e2 9d4b f39c 45f6 1d22 96e9 9e6e 53ea ...K..E.."...nS. 0x04f0: ca12 0ec5 9d3b 7f69 661c 8a27 eeb5 937f .....;.if..'.... 0x0500: cfd4 2564 b36d a5b5 e25f 9f1f 1a9a 08e2 ..%d.m..._...... 0x0510: 5de1 3388 5faf 721e 4710 f736 a520 1e28 ].3._.r.G..6...( 0x0520: 7de5 119a 074c 2e06 dc34 0b54 08e2 4dad }....L...4.T..M. 0x0530: f1d1 1e20 880f 0896 7b5d e74b 4869 cb9c ........{].KHi.. 0x0540: b41d cbbd bc68 b963 c1f2 11c2 f286 ca84 .....h.c........ 0x0550: 5dcb bda8 ]... 18:27:29.887331 64:00:f1:27:f8:9e > 00:00:0c:9f:f0:65, ethertype Unknown (0x8926), length 1378: 0x0000: 0000 0014 8100 0065 0800 4500 054a 353d .......e..E..J5= 0x0010: 4000 7f06 b863 0a4d fc61 0a4b f813 d322 @....c.M.a.K..." 0x0020: 01bd 3238 e063 2857 8328 5010 00ff a8ea ..28.c(W.(P..... 0x0030: 0000 7a93 caeb d422 883b 26cd 42f2 1142 ..z....".;&.B..B 0x0040: f211 42f2 1142 7287 7624 2745 e688 e49d ..B..Br.v$'E.... 0x0050: 52b3 2651 da8b 7bd6 4d49 2e7d 87e4 cedd R.&Q..{.MI.}.... 0x0060: f51d 4b38 ee98 1686 e34e ddf5 3e1d 0bf5 ..K8.....N..>... 0x0070: c65a f173 3d22 2e4f 54a0 7823 cf48 fea9 .Z.s=".OT.x#.H.. 0x0080: ef3e 4371 af2c 29ee 941d e7a0 b863 699d .>Cq.,)......ci. 0x0090: 1e28 bd87 4524 6f6c 0d8f 2238 3e20 38ee .(..E$ol.."8>.8. 0x00a0: 95d9 3928 ebf4 8485 38ee 58bc 5f16 b057 ..9(....8.X._..W 0x00b0: df88 e323 84e1 0d4d 867b 5136 3c18 ee58 ...#...M.{Q6<..X 0x00c0: 307c 8430 7c84 307c 8430 dca1 1dc3 4993 0|.0|.0|.0....I. 0x00d0: 3962 78a7 d5ac 2994 0cf7 cc9b ab7d c513 9bx...)......}.. 0x00e0: c39d 3b6b c4c4 f080 c9e5 02c3 0375 95a1 ..;k.........u.. 0x00f0: c0f0 c6da f0d3 8f0f cd93 c5f0 4656 10d7 ............FV.. 0x0100: f73b 62b8 5796 0c77 eaac f703 31dc b164 .;b.W..w....1..d 0x0110: 78a0 4210 6f6a 8d8e 7ed1 15c1 0704 c1bd x.B.oj..~....... 0x0120: aeb3 9e16 2278 c2a4 4d84 70c7 2eb2 1de3 ...."x..M.p..... 0x0130: 34dd 2919 3dfc 1e21 fc6e 68f2 db8b b2c1 4.).=..!.nh..... 0x0140: c16f c7a4 5944 f011 c2ef 11c2 ef11 c26f .o..YD.........o 0x0150: 87de fb7d 3e98 d9f6 93df df86 6fc8 f7ad ...}>.......o... 0x0160: 4bf9 2ddd 527e 072e f99d 30f7 3b51 c1ef K.-.R~....0.;Q.. 0x0170: 0ddb f37b 43f6 fc0e 95e9 effb e3cd ef93 ...{C........... 0x0180: 1543 f99d 0a93 856e 2dd2 1325 2e55 00df .C.....n-..%.U.. 0x0190: a8e5 b73e c656 7e4f 48f9 1dea 4a7e 474c ...>.V~OH...J~GL 0x01a0: da54 7e07 2cf8 1d28 9931 e5f7 0c95 df1b .T~.,..(.1...... 0x01b0: 34f8 1d8a 4a7e 074c 9a55 7ecf 50f9 3d43 4...J~.L.U~.P.=C 0x01c0: e5f7 0c95 df01 daf1 bb34 3c12 bfcf f083 .........4<..... 0x01d0: df8d 88df 32b1 f1db b9e8 77c0 82df 814a ....2.....w....J 0x01e0: 7e37 d67e dfce e965 6d5b b376 fdf6 ca92 ~7.~...em[.v.... 0x01f0: df4e d914 c26f c742 fc4e 94b8 84df 5dd6 .N...o.B.N....]. 0x0200: 2fbf 05c1 ef01 c16f 6f51 f43b 6152 217e /......ooQ.;aR!~ 0x0210: 3b96 fc76 4a44 c2ef 11c2 ef86 26bf bd28 ;..vJD......&..( 0x0220: 1b9c 8adf 738d f8ed 6549 dbf1 7b84 f07b ....s...eI..{..{ 0x0230: 84f0 dba1 1dbf 498d 39b0 3e3f 772a cd9a ......I.9.>?w*.. 0x0240: 4161 7dbe 21d5 8a75 c451 f15b 4212 7e7b Aa}.!..u.Q.[B.~{ 0x0250: 564e f43b 60c1 ef40 25bf 1bdb 8ddf 8dec VN.;..@%....... 0x0260: faed 9525 bf9d b229 84df 8e69 6711 bf03 ...%...)...ig... 0x0270: 252e e177 536b 74f4 640c bf07 04bf bdae %..wSkt.d....... 0x0280: e877 c2a4 4df8 ed58 f2db 2971 04bf 4708 .w..M..X..)q..G. 0x0290: bf1b 9afc f6a2 6c70 f0db 3169 167e 8f10 ......lp..1i.~.. 0x02a0: 7e8f 107e 8f10 7e3b b4e3 37a9 3147 fcee ~..~..~;..7.1G.. 0x02b0: 549a 3583 92df 9e6d 537e cbc0 e3b7 7337 T.5....mS~....s7 0x02c0: 7de1 61ed bf03 a679 5ab5 ff0e 54bd 40fe }.a....yZ...T.@. 0x02d0: f584 e6cf 0b6b bf53 beea 564e db5d 25f8 .....k.S..VN.]%. 0x02e0: 1786 6355 32e8 acce fdd7 d911 2d76 074c ..cU2.......-v.L 0x02f0: 2e85 d81d 287d 972c 7a37 b606 27e4 ab2a ....(}.,z7..'.. 0x0300: a2e3 87de 5e59 bd7e f8b5 2b6b fb1d 31e9 ....^Y.~..+k..1. 0x0310: 07f4 f6d2 52be 6ac0 a42c fcf6 b2ea 8584 ....R.j..,...... 0x0320: af2d c3f0 c626 c3bd 301b 200c 774c 1a86 .-...&..0...wL.. 0x0330: e123 84e1 2384 e123 84e1 0ebd cf57 3d93 .#..#..#.....W=. 0x0340: 1b73 c4f0 cea5 5993 4867 c86f 55bf a7db .s....Y.Hg.oU... 0x0350: 94e1 72b6 8ae1 9193 5409 1477 2e1c a207 ..r.....T..w.... 0x0360: aa6a 95a3 1c1c efd2 b618 7ea9 17ad 8a50 .j........~....P 0x0370: 7f59 cc16 c44f 6735 e5af 0bf9 be4c 4941 .Y...Og5.....LIA 0x0380: dc9b 5e8d 920b 0f9e 3b97 a2b8 53e1 86f8 ..^.....;...S... 0x0390: 56d6 1a21 bd07 4014 ef82 de22 68ee 7555 V..!..@...."h.uU 0x03a0: cb65 e584 e789 d373 5244 77ae fecf 5739 .e.....sRDw...W9 0x03b0: eba0 2d60 e213 a27b 5902 a179 4393 e65e ..-`...{Y..yC..^ 0x03c0: 940f 109e 3b27 55e2 f908 e1f9 08e1 f908 ....;'U......... 0x03d0: e1b9 43df 0648 f2d2 cf64 c71c f1bc b369 ..C..H...d.....i 0x03e0: d614 499e 7bc2 8df4 0992 3b74 bdeb d21a ..I.{.....;t.... 0x03f0: c99d 4b92 3b75 ba69 ba25 9237 d792 4b70 ..K.;u.i.%.7..Kp 0x0400: c2ef fef3 e6f7 e7a7 de9d c7ef 50d3 eb6c ............P..l 0x0410: 258a 3ba4 39b0 c8ed 544a 7709 587a ea64 %.;.9...TJw.Xz.d 0x0420: c3d6 c084 3be1 1382 dede a6ea 48b9 30a1 ....;.......H.0. 0x0430: 77e4 e432 80de 81d3 5b13 e81d b0d7 5e45 w..2....[.....^E 0x0440: ef00 ddf4 134d 18de dc64 b897 a6bf 13bf .....M...d...... 0x0450: 9d92 b98c df23 84df 2384 df23 84df 0eed .....#..#..#.... 0x0460: f85d dd70 c86f f8e1 a4ad 91ef 21ae d495 .].p.o......!... 0x0470: 6b36 8a47 4ea2 2a8a 3b97 1477 eaa2 299b k6.GN..;..w..). 0x0480: 18de d8b6 54bf 9d2f e70f 5dd0 237a 53cf ....T../..].#zS. 0x0490: ddf8 59a7 24a2 87fa 64e8 313d 507a dd41 ..Y.$...d.1=Pz.A 0x04a0: f580 4947 b05e 0f94 6c80 58ae 37f5 14bd ..IG.^..l.X.7... 0x04b0: 2ef7 afa6 10c7 1591 4516 a287 ba74 fee3 ........E....t.. 0x04c0: 79c2 82e6 01bb ebeb 2ef0 dc39 e953 3c1f y..........9.S<. 0x04d0: 2124 6fa8 fe5d c741 ba7e fadb a2be 4fd5 !$o..].A.~....O. 0x04e0: 8b0e 0f96 8f35 62f9 0861 f908 61f9 0861 .....5b..a..a..a 0x04f0: b943 3b96 931e 7324 8a77 3acd 730e a5b4 .C;...s$.w:.s... 0x0500: b6b3 67dc 94e5 32d7 b0dc b9f4 9478 c092 ..g...2......x.. 0x0510: e45e d8f9 a64f 8761 7973 db62 3d3f 25be .^...O.ays.b=?%. 0x0520: 31bf 1c17 e170 dcab 4b8b 75a7 bef4 a368 1....p..K.u....h 0x0530: 38ee 585a ab07 4a3a 15c7 9b5a e313 1e12 8.XZ..J:...Z.... 0x0540: 9f10 1cf7 baaa 3745 3824 8f9c 5cd0 09e6 ......7E8$..... 0x0550: cea5 a497 ....

How do I get this working properly ?? GitHub automagically formats a lot of the above and it's a pita to unformat ;)

dougburks commented 7 years ago

Hi @chppppp ,

Please send this to our security-onion mailing list: https://github.com/Security-Onion-Solutions/security-onion/wiki/MailingLists