In this section, we’ll cover creating a virtual machine (VM) for our Security Onion 2 ISO image in VMware Workstation Pro and VMware Fusion. These steps should be fairly similar for most VMware installations. If you don’t already have VMware, you can download VMware Workstation Player from http://www.vmware.com/products/player/playerpro-evaluation.html.
With the sniffing interface in
bridged mode, you will be able to see all traffic to/from the host machine’s physical NIC. If you would like to see ALL the traffic on your network, you will need a method of forwarding that traffic to the interface to which the virtual adapter is bridged. This can be achieved by switch port mirroring (SPAN), or through the use of a tap.
VMware Workstation is available for many different host operating systems, including Windows and several popular Linux distros. Follow the steps below to create a VM in VMware Workstation Pro for our Security Onion ISO image:
- From the VMware main window, select File >> New Virtual Machine.
- Select Typical installation >> Click
- Installer disc image file >> SO ISO file path >> Click
- Choose Linux, CentOS 7 64-Bit and click
- Specify virtual machine name and click
- Specify disk size (minimum 200GB), store as single file, click
- Customize hardware and increase Memory (minimum 12GB for most use cases) and Processors (minimum 4 CPU cores for most use cases).
- Network Adapter (NAT or Bridged – if you want to be able to access your Security Onion machine from other devices in the network, then choose Bridged, otherwise choose NAT to leave it behind the host) – in this tutorial, this will be the management interface.
- Add >> Network Adapter (Bridged) - this will be the sniffing (monitor) interface.
- Power on the virtual machine and then follow the installation steps for your desired installation type in the Installation section.
VMware Fusion is available for Mac OS. For more information about VMware Fusion, please see https://www.vmware.com/products/fusion.html.
Follow the steps below to create a VM in VMware Fusion for our Security Onion ISO image:
- From the VMware Fusion main window, click
Fileand then click
Select the Installation Methodappears. Click
Install from disc or imageand click
Create a New Virtual Machineappears. Click
Use another disc or disc image..., select our ISO image, click
Open, then click
Choose Operating Systemappears. Click
CentOS 7 64-bit, then click
Choose Firmware Typeappears. Click
Legacy BIOSand then click
Finishscreen appears. Click the
Save Asscreen appears. Give the VM a name and click the
Settingswindow appears. Click
Processors & Memory.
Processors & Memoryscreen appears. Increase the number of processors to at least
4and memory to at least
12GBdepending on your use case. Click the
Add Devicescreen appears. Click
Network Adapterand click the
Network Adapter 2screen appears. This will be the sniffing (monitor) interface. Select your desired network adapter configuration. Click the
Settingsscreen appears. Click
Hard Disk (SCSI).
Hard Disk (SCSI)screen appears. Increase the disk size to at least
200GBdepending on your use case. Click the
- Close the
- At the window for your new VM, click the
Playbutton to power on the virtual machine.
- Follow the installation steps for your desired installation type in the Installation section.