cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
12012
Views
85
Helpful
10
Comments
John Heintz
Cisco Employee
Cisco Employee

Updated!!

 

Posting this for anyone interested in using a Raspberry PI as a flow collector for Stealthwatch.  We created a very lightweight version of the Stealtwatch Cloud sensor.  It will create flows on any ethernet port, so you can attach LAN port to SPAN and/or forward NetFlow/IPFIX to it.  I would recommend keeping device counts under 100.

 

We now have an IMG file that works on Pi versions 3 or 4.  Thanks to Steven Marin who created it.

 

Cisco Employees get to keep their SWC account as long as it is being usedhttps://www.cisco.com/c/en/us/products/security/stealthwatch/stealthwatch-cloud-free-offer.html

 

Cheers - John

pi.PNG

 

 

 

 

 

 

 

 

 

 

 

 

See attachment for directions on using pre-built Image

 

Package Install on existing PI (not a full image)

 

sudo apt-get install tcpdump

sudo apt-get update && sudo apt-get install -y libglib2.0-0 liblzo2-2 libltdl7 libpcap0.8 zlib1g

wget https://onstatic.s3.amazonaws.com/ona/master/ona-service_RaspbianJessie_armhf.deb

sudo dpkg -i ona-service_RaspbianJessie_armhf.deb

wget https://github.com/bbayles/netsa-pkg/releases/download/v0.1.18/netsa-pkg_raspbian.deb

sudo dpkg -i netsa-pkg_raspbian.deb

 

 

10 Comments
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: