Creating a mirror network. How?

Started by guest17399, November 06, 2018, 08:30:27 AM

Previous topic - Next topic
You need to make a mirror and send it to the port. In this port, I will connect the moloch.
Found nothing in the documentation.

How to be?

In general, I propose to develop a plugin for moloch.
Similar to os-ntopng


You don't do that in OPNSense.

You make a mirror port on a switch and it all depends on your switch.

They also sell devices and such that make it a bit simpler like:

https://www.amazon.com/CyberData-011258-Gigabit-Mirroring-Switch/dp/B00IJFLJ4Y

Quote from: Animosity022 on November 07, 2018, 03:17:54 PM
You don't do that in OPNSense.

You make a mirror port on a switch and it all depends on your switch.

They also sell devices and such that make it a bit simpler like:

https://www.amazon.com/CyberData-011258-Gigabit-Mirroring-Switch/dp/B00IJFLJ4Y
Thank.

Why opnsense can not mirror?

It's not a router thing as it's a switch thing.

It's like asking why isn't an apple an orange.

You can capture all traffic on an interface for troubleshooting, but for analysis on an external host, netflow is better. Reporting, Netflow, Destinations.

Bart...