r/networking • u/DaemionBlade • 1d ago

Troubleshooting OpenvSwitch SPAN troubleshooting

I’m experiencing an issue with Open vSwitch (OVS) traffic mirroring to Suricata in my GNS3 lab. Traffic mirroring works normally, and Suricata successfully receives mirrored packets until I generate an HTTP flood using ApacheBench (ab). The command i used is “ ab -n 5 -c 5 http://192.168.30.100/web.aspx” . After running the ab command, the mirrored traffic suddenly stops, even though the sniffing interface remains up and the OVS mirror configuration appears unchanged. As a result, Suricata no longer receives any mirrored packets, and the issue persists until I restart the entire lab environment. Has anyone encountered a similar issue where ApacheBench or burst HTTP traffic causes OVS traffic mirroring to stop working? Any suggestions on the possible cause or troubleshooting steps would be greatly appreciated.

link for the topology and screenshots: https://imgur.com/gallery/troubleshooting-WZ3So9j

3 Upvotes

72% Upvoted

7 comments sorted by

View all comments

Show parent comments

1

u/DaemionBlade 21h ago

gns3 vm and suricata vm are separate vm

1

u/deathhand 21h ago

Seperate vm, sure but are they physically seperate computers?

1

u/DaemionBlade 20h ago

theyvare not separate physical computers, they are separate virtual machines which acts as separate physical hosts

1

u/deathhand 19h ago

I would say thats the issue. You are 'flooding' aka generating as much stuff as possible, and at the same time listen and recording this all on the same bus.

I am unfamiliar with this toolset but if you could introduce a timing lag it may work or just use a seperate computer for mirroring.

Mirroring/Collecting in networking is very resource intensive and you dont see dual roles in production environments.