Getting Data In

How do I collect packets from all devices on the network?

jencliff
New Member

I am trying to collect all network data. I appear to only be collecting from the device splunk is running on. Until I see data from other devices I don't know which are on and functioning. In no small part that is due to seeing "src_ip" and "dest_ip" values of 127.0.0.1 & 127.0.1.1 I am used to values similar to 192.168.?.?

Do I need to install someting additional?

Tags (1)
0 Karma

pmdba
Builder

127.0.0.1 is your localhost address (i.e. the machine you are monitoring from). It uses this address to send packets to its own network ports for internal communication. Depending on what kind of monitoring you are doing and what kind of physical network you are connected to, you may not be able to see packets from other devices unless they are communicating directly with your monitor host (or it with them). Most physical networks are "switched", which means hosts can only see packets sent directly to or by them.

In general, attempting to capture "all network data" is inadvisable - the volume of packet data present even on a small home network would overwhelm your Splunk license (I don't care how much capacity you have) within minutes unless you limit the scope of information you are attempting to collect, like a few seconds of traffic on a single network port. If your network is larger (like a corporate network) it would overwhelmed in seconds. The kind of monitoring you are describing generally requires specialized hardware - like a firewall or other specialized monitor - to tap into the network in place that can "see" everything, and process what is going on.

If you just want to verify that a machine or set of machines is up and running, use a script or a tool like nmap to send a TCP ping command to each host on a regular schedule and record the result in Splunk. There is an app here called Asset Discovery that does that.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...