Home / server / Questions / 779787
Accepted
GrZeCh
Asked: 2016-05-31 02:14:41 +0800 CST

Separate VMWare ESXi monitored by one Security Onion instance - possible?

  • 772

I'm running multiple VMWare ESXi (free) instances installed on blade system. Is there any possibility to monitor this multiple instances (which are not using any distributed vswitch - each has its own) using one standalone Security Onion instance? Security Onion runned on one ESXi can only monitor VMs from ESXi on which is running (vSwitch promiscious mode enabled) but can't access other ESXi servers VMs ethernet traffic.

Thanks

vmware-esxi vswitch

1 Answers

  1. Best Answer

    It sounds like you're asking if there's a way for a VM on one Standard Switch to see traffic on another, is that right? if so then no, sorry, that's not possible with Standard Switches. You don't even get NetFlow with Standard Switches either so you can't even see the flows, that's just the way the (free) cookie crumbles!

    • 2