# Capture packets on a remote interface **URL:** \ **Category:** Help\ **Created:** [September 6, 2021, 11:16am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684 "2021-09-06T11:16:07Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 6, 2021, 11:16am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/1 "2021-09-06T11:16:07Z")
Hello, I am new , I am using suricata in a separate server. I mean : on VM A (ubuntu) : there is an interface named enp0s8 on VM B (debian) : there is suricata , == So I wanna capture all packets on enp0s8 How can I do that? How can I connect suricata to that port?? NB : there is already a mirror on enp0s8 but I dont know hot to connect suricata on it cause it is in another server Thank you very much ---
**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\ **Post date:** [September 6, 2021, 12:56pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/2 "2021-09-06T12:56:09Z")
Hi, Let’s see if it serves as a clue > [@Suricata remote sensor](https://forum.suricata.io/t/suricata-remote-sensor/117): > > -Remote: Windows 7/10. -Locar: Ubuntu 18.04 -SSH into VPN ssh [windump@192.168.1.29](mailto:windump@192.168.1.29) -p2223 ‘C:/tmp/WinDump.exe -i1 -s0 -U -w - icmp and not port 2223’ | sed ‘1d’ | stdbuf -oL tcpdump -nn -r - -w - | stdbuf -oL suricata -knone -c /etc/suricata/suricata\_no\_dataset.yaml -l ./ -r /dev/stdin -l ./win7\_su\_log Best regards, ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 8, 2021, 7:41pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/3 "2021-09-08T19:41:52Z")
Hello, Thank you very much for out response. But I need to supervise the port remotely every time, not accessing it by ssh , i.e I need continue connection between suricata and this port , how can I do this? Thanks ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 9, 2021, 6:23am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/4 "2021-09-09T06:23:18Z")
What type of virtualisation is it? It would make more sense to forward the traffic from that mirror to an interface at the VM B ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 7:55am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/5 "2021-09-09T07:55:01Z")
I use virtual machine inside Virtualbox , I already created a mirror on vm A openvswitch, and I need suricata to watch this mirror port ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 7:55am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/6 "2021-09-09T07:55:32Z")
The mirror is among the port of the OpenVSwitch ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 7:56am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/7 "2021-09-09T07:56:06Z")
i.e enp0s8 is the mirror port ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 9, 2021, 7:58pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/8 "2021-09-09T19:58:29Z")
Why don’t you mirror the traffic you want to see to an interface that is attached to VM B? ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 8:06pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/9 "2021-09-09T20:06:10Z")
thats’ s what I want to do , but I dont know how to do thatt ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 9, 2021, 8:08pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/10 "2021-09-09T20:08:05Z")
The same way you do forward the traffic to the interface on VM A? I might misunderstand your setup, maybe you can explain it in a bit more detail or draw a small schema to better understand the actual setup and traffic flow. ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 8:22pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/11 "2021-09-09T20:22:46Z")
How can I achieve this, what are the command line I should put in suricata?? ![240879715_291783712278466_4361894948213889358_n](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/fae7e9e49d4c2dcb081afe17861202f5baa20ce8.jpeg) ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 9, 2021, 8:28pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/12 "2021-09-09T20:28:29Z")
So VM A has enp0s8 connected to VM B via an interface? Is enp0s8 also connected to something else and how is the traffic flow? I wouldn’t start looking into how Suricata should run before we figured out what your setup actual looks like and what you want to achieve. ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 8:32pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/13 "2021-09-09T20:32:26Z")
Actually, enp0s8 is not yet connected to suricata, but that’s what I want to do. I want to know : what are the manipulations to do so that suricata can monitor a remote port on another machine ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 8:37pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/14 "2021-09-09T20:37:41Z")
in addition, there is a switch on VMA, and the enp0s8 port is a mirror port located on this switch, (copies of packets transiting inside the VM A switch are available at the enp0s8 level) so I want to continuously scan this port (enp0s8). ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 9, 2021, 8:41pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/15 "2021-09-09T20:41:32Z")
![240921696_1031009547736567_2304448230991073408_n](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/a087626b725739843da148dd0e16b39e75cce7c3.jpeg) ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 9, 2021, 8:47pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/16 "2021-09-09T20:47:26Z")
So openvswitch is running inside the VM A? How did you exactly setup VM A and VM B in VirtualBox? But I guess that would be better solved by VirualBox experts. ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [September 28, 2021, 10:01am UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/17 "2021-09-28T10:01:33Z")
This is what I am trying to do, ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/7/7923b379c00ae96b8a4b6b7d005739e5352c220a.png) VM B contain Suricata. How can I do it? ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 28, 2021, 9:13pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/18 "2021-09-28T21:13:42Z")
What I would to, is to run tcpdump on that NIC and ideally look into the traffic if it’s the correct one and complete. If not it’s something within the forwarding setup. ---
**Author:** ![Yves\_Silvere\_Randria](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/yves_silvere_randria/32/956_2.png) [@Yves\_Silvere\_Randria](https://forum.suricata.io/u/Yves_Silvere_Randria)\ **Post date:** [October 2, 2021, 6:29pm UTC](https://forum.suricata.io/t/capture-packets-on-a-remote-interface/1684/19 "2021-10-02T18:29:09Z")
Thank you very much 😀