Configuring a bridged promisc interface in Security Onion
A few months ago I configured an all in one (server and sensor) Security Onion VM on my ESXi box. It took a while, but I finally found a good box that I could use for a physical sensor. I bought this Barracuda ethernet TAP back around 2007-9, and while it worked great, after I moved to my house, it has literally been collecting dust in my basement for years. Lucky for me, it still works! This is a non aggregating TAP, which means I have two "output" cables coming from the TAP to my IDS. On the physical server, I installed Security Onion as a sensor only, and the TAP interfaces ended up being eth0 and eth2 (eth1 is the mgmt. interface). I quickly realized that I only knew how to bond two interfaces together on CentOS/RedHat. It took a few hours of googling and trial and error, but I finally got eth0 and eth2 bonded/bridged together. Aside from the ...