Trying to send tap data into my virtual IDS

Forums › IT Pro and developers › Trying to send tap data into my virtual IDS

NectarBomb

9 posts

Wannabe Geek
+1 received by user: 1

Topic # 182586 22-Oct-2015 11:51

Hi,

I have a Windows Server 2012 server running on my network with two NIC's. The first is connected to a switch which goes out to the internet. The second is connected to a network tap which I have installed on part of my network.

On my server I have Hyper-V whcih has a virtual machine with an IDS OS running on it.

When I use monitor the tap NIC using Wireshark on the Windows Server I can see all of the tapped traffic however when I go into my IDS and add both NIC's I cannot see this traffic. It seems that the tapped traffic is not going through to the virtual machine for it to be monitored.

Any ideas on how to fix this?

Thanks!

nathan

4928 posts

Uber Geek
+1 received by user: 1312

Trusted

Microsoft

Reply # 1411023 22-Oct-2015 11:59

One person supports this post

port mirroring

https://technet.microsoft.com/en-us/library/jj679878.aspx#bkmk_portmirror

http://www.cloudbase.it/hyper-v-promiscuous-mode/

NectarBomb

9 posts

Wannabe Geek
+1 received by user: 1

Reply # 1411174 22-Oct-2015 14:58

Will this work for pushing my tapped data which is currently going to the host through to the vm. From what I saw it the port mirroring it was about mirroring the nic of one VM to another VM.

nathan

4928 posts

Uber Geek
+1 received by user: 1312

Trusted

Microsoft

Reply # 1411180 22-Oct-2015 15:14

I'm not sure what tapped data means

read the second link. Your IDS is in a VM right?

gbwelly

516 posts

Ultimate Geek
+1 received by user: 196

Subscriber

Reply # 1411184 22-Oct-2015 15:26

There is also this guide:
http://blogs.technet.com/b/networking/archive/2015/01/06/setting-up-port-mirroring-to-capture-mirrored-traffic-on-a-hyper-v-virtual-machine.aspx

NectarBomb

9 posts

Wannabe Geek
+1 received by user: 1

Reply # 1411191 22-Oct-2015 15:48

This is the simplified topology. So the issue is I can monitor the tapped data using wireshark on the host however I cannot see this tapped data on the vm.

nathan

4928 posts

Uber Geek
+1 received by user: 1312

Trusted

Microsoft

Reply # 1411205 22-Oct-2015 15:56

You will learn to love powershell

NectarBomb

9 posts

Wannabe Geek
+1 received by user: 1

Reply # 1411211 22-Oct-2015 16:02

Oh goodie

NectarBomb

9 posts

Wannabe Geek
+1 received by user: 1

Reply # 1411223 22-Oct-2015 16:33

Yup this totally worked

http://www.cloudbase.it/hyper-v-promiscuous-mode/

Used the information about the external network.

Thanks so much team!