Getting Data In

How do I collect packets from all devices on the network?

jencliff
New Member

I am trying to collect all network data. I appear to only be collecting from the device splunk is running on. Until I see data from other devices I don't know which are on and functioning. In no small part that is due to seeing "src_ip" and "dest_ip" values of 127.0.0.1 & 127.0.1.1 I am used to values similar to 192.168.?.?

Do I need to install someting additional?

Tags (1)
0 Karma

pmdba
Builder

127.0.0.1 is your localhost address (i.e. the machine you are monitoring from). It uses this address to send packets to its own network ports for internal communication. Depending on what kind of monitoring you are doing and what kind of physical network you are connected to, you may not be able to see packets from other devices unless they are communicating directly with your monitor host (or it with them). Most physical networks are "switched", which means hosts can only see packets sent directly to or by them.

In general, attempting to capture "all network data" is inadvisable - the volume of packet data present even on a small home network would overwhelm your Splunk license (I don't care how much capacity you have) within minutes unless you limit the scope of information you are attempting to collect, like a few seconds of traffic on a single network port. If your network is larger (like a corporate network) it would overwhelmed in seconds. The kind of monitoring you are describing generally requires specialized hardware - like a firewall or other specialized monitor - to tap into the network in place that can "see" everything, and process what is going on.

If you just want to verify that a machine or set of machines is up and running, use a script or a tool like nmap to send a TCP ping command to each host on a regular schedule and record the result in Splunk. There is an app here called Asset Discovery that does that.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...