How To Create a Bonded Network Interface

Port Bonding

When using a passive or active LAN tap and not an “aggregator” or “mirror port” for monitoring network traffic, both the ‘incoming’ and ‘outgoing’ channels need to be bonded together for IDS systems such as Bro to process as a single network flow channel. This setup involves using a technique called bonding to take two physical interfaces and bond them together, creating a logical interface that we can use for Snort as an example. These instructions assume you are using Linux and more specifically some Debian distribution such as Ubuntu.

Port Bond

Network Interfaces

A network monitor machine has a minimum of two network interfaces which will be bonded into a single logical interface by software. Many times, a third NIC interface will be present on a monitor machine, which can be used for remote access (management port). Normally, we will use an integrated NIC port as the management port and a 3rd-party NIC with dual ports as the monitoring ports. The monitoring ports are connected to the LAN Tap and the packet flow is rejoined internally via port bonding (software-based).

Determine Assigned Network Interfaces to Physical Ports

First, you need to figure out which interface corresponds to the physical NIC ports.

You should see that the 2 interfaces on the dual NIC share similar MAC addresses.

For an additional way to make the determination, install bmon and view live network data flow.

You should see data flowing to the one connected to the Internet (the management port) and NOT the tap interfaces (monitoring ports).

Note which interfaces should be assigned to the management and monitoring ports. For example: em0, p1p1 and p1p2 respectively.

Create Bonded Interface

Now we manually setup the bonded interface.

Troubleshooting Bridge

We now have our bond, but it’s not persistent yet. For that we need to manually update ‘/etc/network/interfaces’:

Add (adjusting network interface names accordingly):

Now restart the computer and see if the new br0 interface is persisted:

Test LAN Tap and Bond

We can now already test very roughly is the LAN tap and interface bonding is working.

Verify br0 interface persisted:

Using the physical LAN Tap, connect it to the monitoring computer. Use bmon to view packets. You should observe data flowing on br0 which is the combination of the two monitor interfaces.

Related Resources

Network TAPs

Integrating Bro with the ELK Stack: http://knowm.org/integrate-bro-ids-with-elk-stack/
Installing Bro on Ubuntu: http://knowm.org/how-to-install-bro-network-security-monitor-on-ubuntu/