Getting Data In

How do I collect packets from all devices on the network?

jencliff
New Member

I am trying to collect all network data. I appear to only be collecting from the device splunk is running on. Until I see data from other devices I don't know which are on and functioning. In no small part that is due to seeing "src_ip" and "dest_ip" values of 127.0.0.1 & 127.0.1.1 I am used to values similar to 192.168.?.?

Do I need to install someting additional?

Tags (1)
0 Karma

pmdba
Builder

127.0.0.1 is your localhost address (i.e. the machine you are monitoring from). It uses this address to send packets to its own network ports for internal communication. Depending on what kind of monitoring you are doing and what kind of physical network you are connected to, you may not be able to see packets from other devices unless they are communicating directly with your monitor host (or it with them). Most physical networks are "switched", which means hosts can only see packets sent directly to or by them.

In general, attempting to capture "all network data" is inadvisable - the volume of packet data present even on a small home network would overwhelm your Splunk license (I don't care how much capacity you have) within minutes unless you limit the scope of information you are attempting to collect, like a few seconds of traffic on a single network port. If your network is larger (like a corporate network) it would overwhelmed in seconds. The kind of monitoring you are describing generally requires specialized hardware - like a firewall or other specialized monitor - to tap into the network in place that can "see" everything, and process what is going on.

If you just want to verify that a machine or set of machines is up and running, use a script or a tool like nmap to send a TCP ping command to each host on a regular schedule and record the result in Splunk. There is an app here called Asset Discovery that does that.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...