DENIS

Guide 2 of 3 · about 20 minutes

Passive discovery explained, and where to connect DENIS: SPAN port, TAP or gateway

What DENIS can see depends on where it is connected. This guide explains passive discovery, the difference between a mirror (SPAN) port and a network tap, and how to give DENIS one or more mirror interfaces.

What you need

  • DENIS installed (see the previous guide), or the demo to follow along.
  • A managed switch that can mirror ports, or a network tap.
  • Ideally a second network interface on the DENIS machine for the mirror, for example a USB Ethernet adapter.

Passive discovery: what is visible from anywhere on a segment

A switch sends each machine only the traffic addressed to it, plus broadcast and multicast. Many devices announce themselves that way: ARP when they look for an address, DHCP when they ask for one, mDNS and SSDP when they advertise services, LLDP and CDP from network equipment. From any machine on a segment DENIS sees these, which is enough to discover the devices on that segment without sending anything.

Traffic: visible only where it passes

  • On an ordinary switch port, traffic analysis sees only the DENIS machine’s own traffic.
  • On the router or firewall, DENIS sees what crosses it: traffic to the internet and between routed networks.
  • On a mirror (SPAN) port, DENIS sees a copy of the ports or VLANs you mirror, including traffic between your own devices on that switch.
  • On a network tap, DENIS sees everything on that one cable.
  • Several segments or sites need one collector each, reporting to one console.
  1. Your networkPCs · servers · cameras · PLCs · HMIs
  2. SPAN / mirror port or TAPread-only copy
  3. one way
  4. DENISdecodes, does not transmit on the mirror
A mirror port or tap gives DENIS a copy of the traffic. DENIS listens on it and sends nothing back into it.

SPAN port or tap?

  • A SPAN port costs nothing on a managed switch and can mirror several ports or VLANs. A busy switch may drop mirrored frames, and two overlapping mirror sessions can deliver the same packet twice.
  • A tap copies one link completely and independently of the switch, but needs a short interruption to install and one tap per link.
  • For a first look, mirror the uplink between the core switch and the router or firewall: it carries traffic to the internet and between networks.

Steps

  1. Create a mirror session on the switch

    Every switch family has its own syntax: follow your switch’s documentation. Mirror the ports or VLANs you care about to a free port, in both directions, and connect that port to the DENIS machine’s second interface. On Cisco IOS a local session takes this form (interface names are examples):

    monitor session 1 source interface Gi1/0/1 both
monitor session 1 destination interface Gi1/0/24

  2. Give DENIS the mirror interface

    The normal interface keeps doing discovery; the mirror interface is capture-only: never probed and needs no IP address. When the mirror carries a different subnet or VLAN than the normal interface, name its range with --mirror-subnet, otherwise its traffic is not recognised as local and nothing is decoded for it.

    In the console, administrators can add, switch off and remove mirror interfaces under Settings → Capture without a restart, and list the monitored networks there.

    $ denis run --iface eth0 --mirror-iface eth1 --mirror-subnet 10.20.0.0/24

  3. Check that traffic arrives

    The Health page shows each interface’s state (capturing, no traffic, no link, missing, capture error or switched off), its counters and its last packet. A quiet mirror is shown as “no traffic”, not as broken. Within minutes, the Dashboard trends and the device panels should show traffic between your devices.

  4. Industrial networks

    On a control network, start DENIS with the OT profile, which switches all active discovery off. Mirror the switch that carries the cell or area traffic: layer-2 protocols such as GOOSE and PROFINET real-time traffic stay inside their switch or VLAN.

    $ denis run --profile ot --iface eth1

  5. Mirrors over VLANs and tunnels

    A remote mirror carried in a VLAN (RSPAN) is read like a local one. Mirrors delivered in ERSPAN, GRE, VXLAN or Geneve tunnels can be read with --tunnel-mirror (opt-in); this has been verified on hand-built frames and public captures, not yet on real switches or cloud mirrors.

Troubleshooting

  • The mirror interface shows packets, but no traffic appears for its devicesThe mirror carries a subnet DENIS does not know. Add it with --mirror-subnet or under Settings → Capture → Monitored networks. Traffic from a device that discovery has not found yet is dropped until it is found.
  • The interface shows “no link”Check the cable and that the switch port is the session’s destination. DENIS keeps running and retries the interface by itself.
  • Counts look doubledTwo mirror sessions or a mirror plus a tap deliver the same packet twice. The page What DENIS cannot see (Health) shows how many arrive twice, and since 4.3 DENIS can count or remove the copies. Mirroring each link once is still the better setup.
  • Industrial devices are missingIndustrial conversations are visible only where they cross the mirrored port; mirror the cell switch, not only the uplink.

Known limitations

  • DENIS cannot read encrypted traffic, only who talks to whom, when and how much.
  • A switch under load may drop mirrored frames; a tap does not.
  • Traffic between two of your own devices (east-west) is recorded only when you switch it on.

In the documentation

Next guide: Switch visibility over SNMP

Something did not work as described? Tell us on GitHub or in the community.