Suricata Network monitoring

Help
1

Hi !

I have installed suricata version6.0.6. Currently it is running in IDS mode
In home_network I have specified my Vnet range in which there are many servers.
But when I see the eve.json file I am not getting any logs related to those servers. (I cant see the Ip address of any server other than Suricata server )
Please suggest me any workaround so that I can see the clear logs of all the server in eve.json file to determine what traffic is being detected in all the server.

Kindly respond to this ASAP as I am in the middle of an audit. Thanks for help in advance.

2

Hi. Is there any reason your server should recieve traffic destined for other hosts?
Getting the packets to Suricata in IDS mode is usually done using either network TAPs or SPAN ports on routers/switches. I would recommend looking into the latter.

Not sure what your timeline on the audit is, but setting up Suricata with little time and IDS expertise is not something that is done in an instant.