Not seeing traffic

[DigiAngel]

So I have a machine that listens to several netblocks. I am wanting to listen to just the external traffic. This external traffic only has routable IP addresses, we don't see any internal only (10.0.0.0/8, 192.168.0.0/24 for example) traffic. This traffic is on eth2:

MONITOR_INTERFACE eth2

This interface is in promiscuous mode:

eth2      Link encap:Ethernet  HWaddr 00:00:00:00:00:01
          UP BROADCAST RUNNING NOARP PROMISC MULTICAST  MTU:1500  Metric:1

I do not see any events on this interface, even though I do see hits from say, bro-ids:

139.196.104.39  58928   x.x.x.x       443     -       -       -       139.196.104.39  Intel::ADDR     Conn::IN_ORIG   bro     alienvault

If I set maltrail to any, I see hits, but only internal. Is there something I can do to troubleshoot this? Thaank you.

[stamparm]

1. Please turn on SHOW_DEBUG true in maltrail.conf. Then rerun the sensor.py. Please tell if some errors occur
2. Can you please tcpdump some traffic on eth2 and send it to miroslav@sqlmap.org? Maybe there is some encapsulation going on. Have to check it in raw tcpdump
3. You could try python -m SimpleHTTPServer 8000 and visit the http://xxx.yyy.zzz.www:8000/?id=SELECT%20foobar%20FROM%20users%20WHERE%201%20LIKE%201, where xxx.yyy.zzz.www is the ip address of interface eth2 (if there is none, you could temporary assign the address to it). Request to that link should trigger the suspicious http request.

[DigiAngel]

I'll give your suggestions a try and report here thank you.

[DigiAngel]

Pcap emailed...not seeing any errors in the sensor debug. Thank you.

[stamparm]

@DigiAngel I've spotted the problem. CISCO VLAN tagging included. I have to deal with it and do the proper patch. Will let you know

[DigiAngel]

Awesome...thank you!

[stamparm]

@DigiAngel with the latest patch you'll probably be able to do the capture on that interface. In case of further problems, please let me know

[DigiAngel]

Thanks I will give it a try in the morning.

[DigiAngel]

This is working now...thanks so much!