Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AF_PACKET isn't being enabled for zeek-live container capture #437

Closed
mmguero opened this issue Mar 12, 2024 · 1 comment
Closed

AF_PACKET isn't being enabled for zeek-live container capture #437

mmguero opened this issue Mar 12, 2024 · 1 comment
Assignees
@mmguero
Labels
bug Something isn't working performance Related to speed/performance zeek Relating to Malcolm's use of Zeek
Milestone
v24.03.1

Comments

@mmguero
Copy link
Collaborator

mmguero commented Mar 12, 2024 •
edited
Loading

It would appear that af_packet isn't being enabled for the zeek-live container for capture.

at first blush the issue is probably either one of two things:

  • support is not detected although I don't think this is it, as from what I can tell we default to "yes" if we can't explicitly tell that it's "no"
  • missing lb_custom interface prefix: i think this is the most likely. on hedgehog linux we are specifying this, but not in the container. I think i just need to move this code from here to zeekdeploy.sh so it's used on both.
@mmguero mmguero added bug Something isn't working zeek Relating to Malcolm's use of Zeek performance Related to speed/performance labels Mar 12, 2024
@mmguero mmguero added this to Malcolm Mar 12, 2024
@mmguero mmguero self-assigned this Mar 12, 2024
@mmguero mmguero moved this to In Progress in Malcolm Mar 12, 2024
@mmguero mmguero added this to the v24.03.1 milestone Mar 12, 2024
mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Mar 12, 2024
@mmguero
for idaholab#437; for capture using the zeek-live container, af_packe…
b5f2d78 
…t isn't being used for capture. the issue was a missing `lb_custom.InterfacePrefix=af_packet::` line in zeekctl.cfg, which was being set in Hedgehog Linux but not in Malcolm's zeek Docker container. this fix makes sure that line is enabled in both Malcolm and Hedgehog for zeek live capture
@mmguero mmguero moved this from In Progress to Testing in Malcolm Mar 12, 2024
@mmguero mmguero moved this from Testing to Done in Malcolm Mar 12, 2024
@mmguero
Copy link
Collaborator Author

mmguero commented Mar 12, 2024

zeek-live container's zeek command line now looks like this:

/opt/zeek/bin/zeek -i af_packet::enp0s25 -U .status -p zeekctl -p zeekctl-live -p local -p worker-1-1 local /opt/zeek/share/zeek/site/extractor.zeek zeekctl base/frameworks/cluster zeekctl/auto

note the af_packet

@mmguero mmguero closed this as completed Mar 12, 2024
@mmguero mmguero added the falcon label Mar 18, 2024
This was referenced Mar 27, 2024
Merged
Merged
@mmguero mmguero moved this from Done to Released in Malcolm Mar 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mmguero mmguero

Labels
bug Something isn't working performance Related to speed/performance zeek Relating to Malcolm's use of Zeek
Projects
Malcolm
Status: Released
Milestone
v24.03.1
Development

No branches or pull requests
1 participant
@mmguero