1

We've been experiencing some issues with port mirroring that is used by a Network Intrusion detection system. Our company uses AlienVault as a SIEM and uses a Hyper-V sensor which is used to forward data to the SIEM. The Sensor uses 5 virtual adapters (eth 0 to eth4). The eth 0 is used for management traffic which includes vulnerability scanning. The other ethernet ports are used for port mirroring. I have configured the port mirroring to detect traffic from a VLAN and doing network traffic analysis, I observed that there is no TCP, UDP traffic. Only DHCP and RSTP traffic could be seen

Any suggestions from you guys as to how to solve this issue would be great.

Improve this question
1
  • 1
    You seem to be seeing only broadcast or port-level traffic. Please add the exact device models of your switches, their mirroring configuration and a network diagram to your question. Note that host configurations and issues are explicitly off-topic here.
    – Zac67 ♦
    Commented May 26, 2022 at 9:46

0

Reset to default

Browse other questions tagged or ask your own question.