I have noticed while viewing the conn.log file, that some of the timestamp
fields in the entries are not in chronological order. For example, viewing
a section of this file I see:
Is this normal?
Could anyone running an Arista DCS-7280 for tap aggregation please reach out to me off-list to compare notes with an issue we're seeing? Thanks!
Senior Security Engineer, Cybersecurity and Networking Division
National Center for Supercomputing Applications (NCSA)
University of Illinois, Urbana-Champaign
P: (217) 300-1754 F: (217) 244-1987
Hello, I was asked by a supervisor if we at my company were logging OS Fingerprinting.?
Checked logs for various "operating", "system", "os" "windows", "ATTACK" without luck.
I see there is this policy:
Can you help us answer the question on whether OS Fingerprinting is being logged and which log would I look in? Also, what would I look for?
We are running the following:
zeek version 4.0.3
bro version 2.5
Also, if not present, how would we enable? Looking to see ANY os hitting our network.
I have zeek installed on my DNS server and I need to collect only dns.log.
I am struggling to find that configuration where I could stop monitoring
all other protocols and wanted to monitor only the dns protocol.
Can someone please help?
I apologize if this is a newbie question, but that's it, I am new to this system so I am having a hard time finding out how to add a script snippet to the Zeek configuration files.
I had opened an issue on Zeek Github with the same subject: https://github.com/zeek/zeek/issues/1968
And a developer kindly super-quickly replied with the following code snippet:
redef PacketAnalyzer::SKIP::skip_bytes = 8;
redef PacketAnalyzer::SKIP::default_analyzer = PacketAnalyzer::ANALYZER_ETHERNET;
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_UDP, 7932, PacketAnalyzer::ANALYZER_SKIP);
which is dedicated to change the Skip packet analyzer behaviour in order to strip the HP ERM encapsulation from the UDP packet leaving the raw ehternet frame that Zeek can then analyze.
I have read through all the documentation but I cannot figure out where and how the add the above code.
So I kindly ask you to suggest to which file and syntax insert the above definitions.
Platform is a debian 11, with the 4.2.0 binary packages installed from the opensuse repositories, single node, and all in all the installation and first operation was a breeze.
Thank you in advance