I am new to Zeek and will be setting up a Zeek system which will use a 10G NIC. I am not sure what NIC/driver configuration to use, and have some questions about PF_RING and AF_Packet. At …
https://docs.zeek.org/en/current/cluster-setup.html#using-pf-ring
… it looks like PF_RING, also known as "Vanilla PF_RING" …
https://www.ntop.org/guides/pf_ring/vanilla.html#vanilla-pf-ring
… makes it possible to assign worker processes to CPU cores by using "packet clustering" …
https://www.ntop.org/guides/pf_ring/vanilla.html#packet-clustering
Is this essentially implementing symmetric Receive Side Scaling?
If so, can Vanilla PF_RING take advantage of a NIC which does symmetric hashing in hardware?
The Zeek docs reference PF_RING+DNA …
https://docs.zeek.org/en/current/cluster-setup.html#using-pf-ring
… although from looking at the ntop site, DNA/Libzero was replaced some time ago with PF_RING ZC (Zero Copy) …
https://www.ntop.org/guides/pf_ring/zc.html
Does Zeek support PF_RING ZC?
If so, in Zeek's node.cfg, how does one know what options to use for …
interface=
lb_method=
It looks like the AF_Packet plugin …
https://github.com/J-Gras/zeek-af_packet-plugin
… does what Vanilla PF_RING does, in that it allows Zeek to have multiple worker processes which use different CPU cores. Can AF_Packet take advantage of a NIC which does symmetric hashing in hardware?
It looks like AF_Packet does not provide a "Zero Copy" type of functionality, found in PF_RING ZC. Is that correct?
I know this is a lot of questions. Any guidance is appreciated.
-- Steve.
We run 2 redundant Zeek clusters, which provides some safeguards against
individual host or process failure, and virtually eliminates downtime due
to periodic maintenance.
However, ingesting terabytes of logs daily into Splunk eats into our Splunk
license. Has anyone tried deduplicating redundant Zeek logs before sending
them to Splunk (or Elastic Stack, Humio, Graylog, etc.)?
My other thought is to simply not send one redundant set to Splunk unless
an outage has occurred, but I thought I'd check on deduplication.
--
Chris Herdt
Security Analyst | University Information Security (UIS)
University of Minnesota | umn.edu
he, him, his
Hi,
Transitioning from the previous experience of developing analyzer in
Binpac, I find that Spicy provides some additional flexibility,
independence, and portability, making zeek-side of the codes cleaner. I
have already tried to develop an application layer analyzer for a custom
protocol based on TCP that I used for the class that I am teaching right
now.
From Spicy documentation, I see that we can also use Spicy to develop
analyzers on top of "RawLayer" as well as over TCP/UDP. *My question is
that is it possible to use Spicy to develop analyzers for protocols in
middle layers? For example, for protocol running directly on top of
Ethernet or protocols running directly on top of IP layer?*
Thank you and best regards,
Hui Lin
Hello,
Is there a page that tracks Zeek security advisories, or at least a page tracking known Zeek vulnerabilities and affected versions?
Thank you
AN
——
From the email inline:
Traceback (most recent call last):
File "/opt/zeek/lib/zeek/python/SubnetTree.py", line 14, in
swig_import_helper
return importlib.import_module(mname)
File "/usr/lib/python3.6/importlib/__init__.py", line 126, in
import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "<frozen importlib._bootstrap>", line 994, in _gcd_import
File "<frozen importlib._bootstrap>", line 971, in _find_and_load
File "<frozen importlib._bootstrap>", line 955, in
_find_and_load_unlocked
File "<frozen importlib._bootstrap>", line 658, in _load_unlocked
File "<frozen importlib._bootstrap>", line 571, in module_from_spec
File "<frozen importlib._bootstrap_external>", line 922, in
create_module
File "<frozen importlib._bootstrap>", line 219, in
_call_with_frames_removed
ImportError: dynamic module does not define module export function
(PyInit__SubnetTree)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/opt/zeek/bin/trace-summary", line 30, in <module>
import SubnetTree
File "/opt/zeek/lib/zeek/python/SubnetTree.py", line 17, in <module>
_SubnetTree = swig_import_helper()
File "/opt/zeek/lib/zeek/python/SubnetTree.py", line 16, in
swig_import_helper
return importlib.import_module('_SubnetTree')
File "/usr/lib/python3.6/importlib/__init__.py", line 126, in
import_module
return _bootstrap._gcd_import(name[level:], package, level)
ImportError: dynamic module does not define module export function
(PyInit__SubnetTree)
Command exited with non-zero status 1
0:00.27 real, 0.09 user, 0.00 sys, 0K total memory
--
[Automatically generated.]
James
Zeek 4.0.0 is now available:
https://zeek.org/get-zeek/
This is a Long-Term Support (LTS) release, receiving critical
bug-fixes and security patches for the next year. The previous LTS
branch of Zeek 3.0.x may still receive any important security patches
for the next two months, but won't be maintained afterward.
General info about this release can be found in the release notes as
well as a previous blog post from the release-candidate phase:
https://github.com/zeek/zeek/releases/tag/v4.0.0https://zeek.org/2020/12/15/zeek-4-0-release-candidate/
