Deployment Architecture

Splunk running on my linux server is only showing me events from my local subnet, what is going on?

jbsplunk
Splunk Employee
Splunk Employee

Splunk is running on my Linux box, and everything appears to be operating almost correctly. I have data coming in from a LogLogic box via UDP, and that data is being spoofed in such a way to make it appear as though the data is coming from the originating sources, and not the LogLogic device which sits on the same network as Splunk.

I am getting events, however, these events are only from my local subnet. When I change the subnet mask for the interface the events are arriving on, I can see events that are included in the range allowed by that subnet mask.

For example, If I use a /24 mask, I see events from the local network. If I use a /18, I see events from the Class B network. However, I do not see events that are from outside of the local network.

How can I resolve this?

1 Solution

jbsplunk
Splunk Employee
Splunk Employee

When using IPv4 packet forwarding, you will also get the rp_filter, which automatically rejects incoming packets if the routing table entry for their source address doesn't match the network interface they're arriving on. This has security advantages because it prevents the so-called IP spoofing, however it can pose problems if you use asymmetric routing (packets from you to a host take a different path than packets from that host to you) or if you operate a non-routing host which has several IP addresses on different interfaces.

You can turn this off by editing /etc/sysctl.conf, set net.ipv4.conf.default.rp_filter = 0

View solution in original post

jbsplunk
Splunk Employee
Splunk Employee

When using IPv4 packet forwarding, you will also get the rp_filter, which automatically rejects incoming packets if the routing table entry for their source address doesn't match the network interface they're arriving on. This has security advantages because it prevents the so-called IP spoofing, however it can pose problems if you use asymmetric routing (packets from you to a host take a different path than packets from that host to you) or if you operate a non-routing host which has several IP addresses on different interfaces.

You can turn this off by editing /etc/sysctl.conf, set net.ipv4.conf.default.rp_filter = 0

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...