Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

NSX Network Detection and Response - Using interface bonding on the sensor (900099)

Last Updated: 9/14/2023Categories: InformationalTotal Views: 791Language:
English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Details

Description

This article briefly describes the steps that are required to setup interface bonding on a sensor. Interface bonding can be useful to multiplex together packets delivered to multiple sniffing interfaces. The typical use case for this is the operation with hardware tap devices who deliver inbound and outbound packets on two separate network interfaces.

Known issues

It should be noted that at the time of writing the use of interface bonding has some minor side-effects on the sensor operation. More specifically, the use of interface bonding causes certain appliance metrics (network traffic processed and packet processed) to stop operating correctly. This does not affect however the overall operation of the sensor.

While interface bonding can be applied on both 1Gbps and 10Gbps interfaces, when using bonding we loose support for NIC hardware queues (RSS). The performance of a 10Gbps sensor with interface bonding is therefore lower than its non-bonding counterpart.

Solution

Implementation

The interface bonding configuration mostly relies on the underlying Ubuntu OS support (https://help.ubuntu.com/community/UbuntuBonding).

Note: The interface names below are an example, please update eth4 and eth5 to the relevant interfaces names specific to your deployment.

1. Before proceeding to the configuration, deactivate the interfaces you intend to bond together. In this example, let's assume that the relevant interfaces are eth4 and eth5:

ifdown eth4
ifdown eth5

2. Edit the ubuntu network configuration file (/etc/network/interfaces) in order to define the bonding interface. Notice that entries for the sniffing interfaces eth4 and eth5 are likely to be already present, but they need to be updated with a reference to the bond-master. Example:

auto eth4
iface eth4 inet manual
up ip link set eth4 up promisc on
down ip link set eth4 down
bond-master bond0

auto eth5
iface eth5 inet manual
up ip link set eth5 up promisc on
down ip link set eth5 down
bond-master bond0

auto bond0
iface bond0 inet manual
bond-mode 0
bond-slaves eth4 eth5

3. Activate the new bond0 interface created in step 2 and the slaves interfaces:

ifup bond0
ifup eth4
ifup eth5

4. Run lastline_setup and configure the bonded interface as a sniffing interface.

root@lastline-sensor:~# lastline_setup
Lastline Enterprise Sensor Configuration Interface
-> sniffing_interfaces bond0
sniffing_interfaces = bond0
-> save

After applying the configurations, you should see this line as part of the output:

INFO - Applying configuration finished successfully.

You can check the status of the bond0 interface by running:

cat /proc/net/bonding/bond0

Related Information

Note: This article is applicable to the standalone NSX Network Detection and Response product (formerly Lastline) and is not intended to be applied to the NSX NDR feature of NSX-T.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware NSX Defender

Related Versions:

Take Our Survey

Support Assistant