Getting Data In

How do I collect packets from all devices on the network?

New Member

I am trying to collect all network data. I appear to only be collecting from the device splunk is running on. Until I see data from other devices I don't know which are on and functioning. In no small part that is due to seeing "src_ip" and "dest_ip" values of 127.0.0.1 & 127.0.1.1 I am used to values similar to 192.168.?.?

Do I need to install someting additional?

Tags (1)
0 Karma

Builder

127.0.0.1 is your localhost address (i.e. the machine you are monitoring from). It uses this address to send packets to its own network ports for internal communication. Depending on what kind of monitoring you are doing and what kind of physical network you are connected to, you may not be able to see packets from other devices unless they are communicating directly with your monitor host (or it with them). Most physical networks are "switched", which means hosts can only see packets sent directly to or by them.

In general, attempting to capture "all network data" is inadvisable - the volume of packet data present even on a small home network would overwhelm your Splunk license (I don't care how much capacity you have) within minutes unless you limit the scope of information you are attempting to collect, like a few seconds of traffic on a single network port. If your network is larger (like a corporate network) it would overwhelmed in seconds. The kind of monitoring you are describing generally requires specialized hardware - like a firewall or other specialized monitor - to tap into the network in place that can "see" everything, and process what is going on.

If you just want to verify that a machine or set of machines is up and running, use a script or a tool like nmap to send a TCP ping command to each host on a regular schedule and record the result in Splunk. There is an app here called Asset Discovery that does that.

0 Karma