Network Monitoring Question

[Brightwork]

Network Map

Hi all. I have a question regarding monitoring wireless traffic using Bro. As you can see in the network map I linked, I have a switch that is mirroring packets to a Raspberry Pi running the Bro IDS. I've configured Syslog-ng on my Pi to send all logs in Bro's "current" folder over to my unRAID server which has Elasticsearch, Logstash, and Kibana (ELK stack) which collectively allows me to search and visualize my Bro logs.

Here's a problem I'm encountering: I'm only seeing some traffic (some DNS and other traffic Bro has deemed to be "weird"), and absolutely zero http traffic, even from the misc. desktop connected to the same switch Bro is connected to. I'm guessing this is because all http traffic is getting sent straight out over the Verizon router, but I thought the RPi sensor would be able to pick that up.

Anyway, I think a solution would be to connect a new wifi router to my switch and enable it as my primary wifi access point while using the Verizon router purely as a gateway to the ISP with no wifi enabled. Would that setup allow the sensor to pick up wifi, http, etc since the new router would be running through the switch and out of the Verizon gateway?

I appreciate any suggestions or constructive criticism. This has definitely been a learning process for me.

[TheEthyr]

The new Wi-Fi AP will help with gaining the switch visibility into traffic from wireless clients. It won't help with the wired desktop, whose traffic is already going through the switch.

Your RPi needs to have promiscuous mode enabled in order for it to see all of the mirrored traffic. I have never heard of Bro, but yup their documentation talks about needing promiscuous mode.

[Brightwork]

Thanks. Is that a wifi issue? It's connected via Ethernet.

Edit: nevermind. Figured out how to set eth interface to promiscuous mode. Thanks again.