Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 39 subscribers
  • Views 17041 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Port mirroring

IeM

Hi there,

Want to deploy a monitoring server to visualize and monitor network traffic and behavior in the network.
Therefore I started to try use iptables to configure (port) mirroring.

iptabes -I POSTROUTING -t mangle ! -s 127.0.0.1 -J TEE --gateway 12.34.56.78
iptabes -I PREROUTING -t mangle ! -s 127.0.0.1  -J TEE --gateway 12.34.56.78

Unfortunately by adding these rules a high CPU utilization by the IDS (snort) process is observed. Nothing helpful can be found in the log files. Any other suggestions regarding mirroring traffic in user space or kernel space will be appreciated!

Regards,

Ilias.



This thread was automatically locked due to age.
Parents
  • 0

    IeM,

    XG can be deployed in TAP mode using wizard. Do not use custom commands like you did.

    community.sophos.com/.../122971

    Thanks

  • 0 in reply to lferrara

    Hi,

    That’s not for what I am looking for. That article describes to deploy XG in discover mode using a TAP interface with the specific goal: generate security reports from the XG.

    I also read that I need to enable port mirroring on the switch. But doing that is not what I am looking for. Especially because switches with span/mirror ports always give ‘other’ traffic priority and this can lead to missing packets. Someting that’s very crucial when it becomes to mirroring.

Reply
  • 0 in reply to lferrara

    Hi,

    That’s not for what I am looking for. That article describes to deploy XG in discover mode using a TAP interface with the specific goal: generate security reports from the XG.

    I also read that I need to enable port mirroring on the switch. But doing that is not what I am looking for. Especially because switches with span/mirror ports always give ‘other’ traffic priority and this can lead to missing packets. Someting that’s very crucial when it becomes to mirroring.

Children
Unfiltered HTML