Running Security Onion in a Small Lab
Sizing a full NSM stack on a 32 GB mini PC, the installer gotchas, and why placing it in the right segment fixed reachability.
What Security Onion brings
Zeek (connection, DNS, HTTP, TLS and SMB metadata), Suricata (signature alerts), full PCAP, and an Elastic-based UI for hunting and cases. That makes it the lab's eyes. It's also heavy.
Sizing on a mini PC
Starting allocation on a 32 GB node:
| Resource | Value | Why |
|---|---|---|
| vCPU | 4–8 | Zeek + Suricata + Elastic all want cores |
| RAM | 12–16 GB (I went higher, 20–24 GB) | Elastic is the hungry part |
| Disk | ~200 GB | indices and PCAP grow fast |
| NICs | 2 | one management, one monitoring/ingest |
The catch: at 20–24 GB for one VM, pfSense, VyOS and everything else on the node are left with very little. That pressure was part of why the T320 joined CyberDen and workloads were rebalanced.
Installer gotchas
- The management IP field rejects a bare address (
invalid input). It wants CIDR notation:<ip>/24. - Proxy settings can be skipped and added later. A corporate-style egress proxy is on the list for realism.
- Verify the monitoring NIC actually sees traffic before trusting the dashboards:
sudo tcpdump -i <monitor-nic> -n.
Reachability: placement fixed it
SSH and ping to SO were inconsistent for a while. I checked netplan, the host firewall (so-firewall hostgroups for analyst access) and routes. What fixed ping, traceroute and SSH together was moving the VM into its proper SOC segment, so it sat where the routing design expected it. (The sessions that still dropped afterwards were the asymmetric-routing problem from W03.)
DNS hygiene
I'd given SO a public resolver as a second nameserver "to be safe". That bypasses lab DNS. I removed it so SO resolves only through the segment gateway and Pi-hole, set persistently in netplan.
Next
Feed it real traffic: a SPAN/mirror from the core, attack traffic from the red-team segment, and logs from the rest of the lab. Then write up what it actually detects.
Sources: Install Security Onion Proxmox (6 Nov 2025), VM combos for research (6 Nov 2025), Security Onion SSH SOC Setup (11 Jan 2026), VyOS SSH Troubleshooting (Jan 2026)