[Oisf-users] suricata vlan log - onionsecurity is ok, selks ko

[Peter Manev]

On Fri, Feb 27, 2015 at 9:11 AM, john nesh <john.nesh76 at gmail.com> wrote:
> Nope, I think that this is the issue.
> What could I share in order to get troubleshooting faster?

Can you try to see(just to confirm) if there are any vlan counters in
the stats.log (something like..)
grep vlan stats.log | tail -10

Then could you do
suricata --dump-counters |grep vlan


Thanks

>
> 2015-02-26 23:37 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>>
>> On Thu, Feb 26, 2015 at 10:51 PM, john nesh <john.nesh76 at gmail.com> wrote:
>> > Seems not working also in this way.
>> > Is there anything else I could check?
>>
>> Do you have vlan IDs in eve.json ?
>>
>> >
>> > 2015-02-26 21:53 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>> >>
>> >> On Thu, Feb 26, 2015 at 9:43 PM, john nesh <john.nesh76 at gmail.com>
>> >> wrote:
>> >> > You are right,
>> >> >
>> >> > rx-vlan-offload: on
>> >> > tx-vlan-offload: on
>> >> >
>> >> > Do I have to disable it?
>> >>
>> >> Just run that -
>> >> /opt/selks/Scripts/Setup/reconfigure-listening-interface_stamus.sh
>> >>
>> >>
>> >>
>> >> >
>> >> > 2015-02-26 21:04 GMT+01:00 Peter Manev <petermanev at gmail.com>:
>> >> >>
>> >> >> On Thu, Feb 26, 2015 at 8:18 PM, john nesh <john.nesh76 at gmail.com>
>> >> >> wrote:
>> >> >> > Hi,
>> >> >> >
>> >> >> > I am facing a different behaviour regarding vlans in logs.
>> >> >> > I made an installation of securityonion and vlan worked log in
>> >> >> > eve.json
>> >> >> > worked flawlessy but not in selks.
>> >> >> > I have read that vlan behaviour had changed in 2.1
>> >> >> >
>> >> >> > in my suricata.yaml I have:
>> >> >> >
>> >> >> >  vlan:
>> >> >> >    use-for-tracking: true
>> >> >> >
>> >> >> > But I have no log in eve.json.
>> >> >> > Is this an expected behaviour?
>> >> >>
>> >> >> You might have vlan offloading enabled on your NIC - if that is the
>> >> >> case you would need to disable it.
>> >> >> (ethtool -k interface - will show the status)
>> >> >>
>> >> >> >
>> >> >> > John
>> >> >> >
>> >> >> > _______________________________________________
>> >> >> > Suricata IDS Users mailing list:
>> >> >> > oisf-users at openinfosecfoundation.org
>> >> >> > Site: http://suricata-ids.org | Support:
>> >> >> > http://suricata-ids.org/support/
>> >> >> > List:
>> >> >> >
>> >> >> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> >> >> > Training now available: http://suricata-ids.org/training/
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> Regards,
>> >> >> Peter Manev
>> >> >
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >> Regards,
>> >> Peter Manev
>> >
>> >
>>
>>
>>
>> --
>> Regards,
>> Peter Manev
>
>



-- 
Regards,
Peter Manev