vSphere

[impact1560]

Does EasyIDS work with virtual network cards?

[oakleeman]

We use esxi in our development & test installs. We usually bridge the monitoring nic with a physical nic that is able to be put in promiscuous mode.

[impact1560]

I added both virtual networks card to the physical adapter (WAN) and I still not seeing any information in BASE. I can see information from Arpwatch & NTOP. Please see attachments.

Thanks

[oakleeman]

So both your monitoring nic and your management nic are bridged to the same physical nic? I've never been able to get that configuration to work, only a separate physical NIC dedicated to monitoring.

[impact1560]

No, I have two network cards in this box. One for the console another for virtual machines.

[oakleeman]

I was meaning the management nic in EasyIDS, not the vmware console nic. Are your EasyIDS monitor & managment nics both bridged to the vmware non-console nic? Your second picture makes me think that they aren't but then your third picture makes me think that they are. If they are then I don't think that that setup is going to work. I would put a third nic in the server and dedicate it soley to your EasyIDS monitor nic, then connect it to a mirrored port, hub, or dualcomm switch in between your router and your server.