I can only view the sec onion node not my whole network

[kingtay87]

when sec onion is configured and running it will not detect my whole network and i does only one node and that is itself nothing more i tried dmz port forwarding the switch management i have a xb7 xfinity router any ideas are appreciated maybe so-import-pcap?

[tomjones1977]

I am assuming you are talking about network traffic with this problem - what setup do you have to send traffic to your SO server? Do you have a SPAN port enabled on your switch, a network tap? What is physically connected to your sniffing interface?

[kingtay87]

it will not monitor all traffic on the network only the sec onion machine I've tried everything and need help

[tomjones1977]

The Netgear FS105 is an unmanaged switch, so you won't be able to configure a SPAN/mirror port on there. That means that it will only be broadcast traffic that gets to your sniffing interface.

If you want to monitor traffic going between devices on your network you will need either a network tap (expensive) or a managed switch. For example, the GS108Ev3 has a port mirroring capability and is fairly cheap.

Without something to get a copy of the packets to your sniffing interface you will be very limited in what you can monitor.

[kingtay87]

What about both connections cat5e hooked directly up to my xb7 router

[kingtay87]

What about this?????

[tomjones1977]

What about both connections cat5e hooked directly up to my xb7 router

Based on a quick google search it doesn't look like the xb7 has port mirroring either.

The GS605 in the picture is an unmanaged switch too, so no port mirroring.

The problem you have is that you are running a normal switched network. Therefore there's no reason for the router or the switches to send packets destined for your LAN clients to the SO sniffing interface. What you need is a device that will make a copy of the traffic that it sees and send it to security onion. Without this you can still do things like log forwarding to the management interface, but you will not be able to monitor network traffic properly.