Hi all,
Recently I have some problems with Bro and PF_RING in cluster.
On my server, when I have less than 32 worker threads(rings),
everything is okay, but when I use worker threads more than 32, pf_ring
start to receive repeating data packets. For example, rings less than 32, I
send 400000 packets to server and pf_ring info in /proc shows there is
400000 packets in rings, but when rings greater than 32, I can get 800000
packets when 33 rings and 1200000 packets when 34 rings and so on.
I guess if there is some rules that a pf_ring or a bro cluster can only
support less than 32 rings or worker threads on a server or some other
reasons?
Any insight would be helpful.
hi all ;
i am new and i don't have experience with zeek
i try to test this script to detect dns cache poisoning with zeek :
global query_and_id: set[string, int] &write_expire=1min;
event dns_query_reply (c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)
{
if([c$dns$query , c$dns$trans_id] in query_and_id){
print fmt ("Possible DNS cache poisoning attempt --> Source IP: %s, Destination IP: %s, Query: %s", c$id$orig_h, c$id$resp_h, c$dns$query);
return;
}
if(!([c$dns$query, c$dns$trans_id] in query_and_id)){
add query_and_id[c$dns$query, c$dns$trans_id];
}
}
but when i try this script i face this issue
1462583138.084234 expression error in ././try.zeek, line 5: field value missing (c$dns$query)
any help plz
Hi all,
If any would like to help with Virtual ZeekWeek 2020 please let me know
We need:
5 -6 x Volunteers to help co-host
1 x Volunteer to help with Sched to keep the schedule synced
1 x Volunteer to help with Social Media
Please let me know if you are interested in helping.
Thanks,
~Amber
I'm using Zeek 3.1.5.
I need to monitor long running UDP "connections", some lasting two or three days. If I understand correctly, Zeek only logs UDP connections in conn.log on the connection termination. I would also like to log the start of the connection in conn.log.
Any suggestions on how to start with this?
Thanks
Gary
[MSi]
: : : : : : : : : : : : : : : : : : : : : : : : : : :
Gary Huband
Sr. Software and Systems Engineer
Office: 434.284.8071 x720
Direct: 434.260.4995
Gary(a)MissionSecure.com
: : : : : : : : : : : : : : : : : : : : : : : : : : :
This email and any files transmitted with it are confidential and proprietary and intended solely for the use of the individual or entity to whom they are addressed. Any dissemination, distribution or copying of this communication is strictly prohibited without our prior permission. If you received this in error, please contact the sender and delete the material from any computer.
Problem solved. I don’t know the reason but there is another zeek instance running in the same host. I have stopped all zeek processes and all it is ok now.
Sorry for the noise.
From: Carlos Lopez <clopmz(a)outlook.com>
Date: Wednesday, 16 September 2020 at 12:25
To: "zeek(a)lists.zeek.org" <zeek(a)lists.zeek.org>
Subject: Error upgrading to Zeek 3.0.10 in RHEL8 host
Hi all,
After upgrading my Zeek’s cluster and executing “zeekctl deploy” the following error appears:
==== stderr.log
error in /opt/zeek/share/zeek/base/frameworks/cluster/./setup-connections.zeek, lines 93-95: Failed to listen on INADDR_ANY:47761 (Broker::listen(Broker::default_listen_address, Cluster::self$p, Broker::d
efault_listen_retry))
fatal error: errors occurred while initializing
Maybe is AF_PACKET config related? My current config is:
[manager]
type=manager
host=172.22.58.3
[logger]
type=logger
host=172.22.58.3
[proxy]
type=proxy
host=172.22.58.3
[idps-prod-dmz]
type=worker
host=172.22.58.4
interface=af_packet::idsif0
af_packet_buffer_size=192*1024*1024
[idps-mgmt-vpn]
type=worker
host=172.22.58.5
interface=af_packet::idsif0
af_packet_buffer_size=192*1024*1024
Version 3.0.8 was working perfectly with this config.
Regards,
C. L. Martinez
Hi all,
After upgrading my Zeek’s cluster and executing “zeekctl deploy” the following error appears:
==== stderr.log
error in /opt/zeek/share/zeek/base/frameworks/cluster/./setup-connections.zeek, lines 93-95: Failed to listen on INADDR_ANY:47761 (Broker::listen(Broker::default_listen_address, Cluster::self$p, Broker::d
efault_listen_retry))
fatal error: errors occurred while initializing
Maybe is AF_PACKET config related? My current config is:
[manager]
type=manager
host=172.22.58.3
[logger]
type=logger
host=172.22.58.3
[proxy]
type=proxy
host=172.22.58.3
[idps-prod-dmz]
type=worker
host=172.22.58.4
interface=af_packet::idsif0
af_packet_buffer_size=192*1024*1024
[idps-mgmt-vpn]
type=worker
host=172.22.58.5
interface=af_packet::idsif0
af_packet_buffer_size=192*1024*1024
Version 3.0.8 was working perfectly with this config.
Regards,
C. L. Martinez
Hi all,
Below is the agenda and registration link for the monthly community call.
Please let me know if you have any questions.
Thanks,
~Amber
*Registration Link. - *
https://corelight.zoom.us/meeting/register/tJcldO6qrTMrG9Kwsu6_qHsUeAvdjLmM…
Zeek Community Call - 11 Sep 2020 (30 Minutes)
-
ZeekWeek (10 mins)
-
Schedule can be found at:
https://zeek.org/2020/08/14/save-the-date-virtual-zeekweek-2020-announced/
-
Agenda: Publish end of next week - 18 Sep 2020
-
Registration - You can register at:
https://www.eventbrite.com/e/virtual-zeek-week-tickets-117288632457
-
Zeek Leadership Team (LT) Elections (10 Mins)
-
Current Phase-
https://zeek.org/2020/09/10/testimonial-phase-for-zeek-leadership-team-elec…
-
Nominees
-
Aashish Sharma
-
Fatema Bannat Wala
-
Jeff Atkinson
-
Johanna Amann
-
Keith Lehigh
-
Nick Turley
-
Scott Campbell
-
Seth Hall
-
Vlad Grigorescu
-
More information about the election process -
https://zeek.org/2020/08/12/zeek-leadership-team-elections-nominations-phas…
-
Zeek Package Contest (ZPC-3) (10 Mins)
-
Current Phase - Developer -
https://zeek.org/2020/08/21/zpc-3-developers-phase-open/
-
More Information -
https://zeek.org/2020/07/15/zeek-package-contest-zpc-3/
-
Important Upcoming Dates -
-
15 September 2020 – Team Notices – We will send out notices to the
Developers and Idea submitters and create a list of teams
-
29 September 2020 – Open Submission of Packages – Individuals and
teams can begin to submit their Zeek Packages via this webform.
-
26 October 2020 – Close Submissions – Individuals and teams will
have until 12 Oct 2020 at 6pm PDT to submit their Zeek Packages.
-
16 November 2020 – Notify Winners – Winners will be notified
privately on this date and arrangements for prize
distributions finalized.
-
30 November 2020 – Announce Winners- On this date we will announce
the winners to the public via the Zeek Blog, Mailing List and Twitter
account. This announcement will also be updated.
Hi all,
The Testimonial Phase for Zeek Leadership Team (LT) elections are now open:
https://zeek.org/2020/09/10/testimonial-phase-for-zeek-leadership-team-elec…
You can find out more about who is running for a seat on the Zeek LT as
well as the election process at the above link.
Please let me know if you have any questions.
Thanks,
~Amber