I’m using Moloch in two cases: during one-shot investigations (PCAP files provided by third-parties) or analysis of my own traffic. If you configure the docker to have access to the local network resources (via ‘-net=host’), you won’t be able to access ElasticSearch. Replace and with your local directories that will contain, respectively, the ElasticSearch data and PCAP files to analyse.īy default, Moloch can sniff traffic passing by the default configured interface (eth0) but this is not possible with the Docker. # docker run -d -name moloch -link elasticsearch:elasticsearch -p 8005:8005 -v /data/tcpdump:/data/pcap:rw danielguerra/docker-moloch # docker run -d -name elasticsearch -v /data/elasticsearch:/usr/share/elasticsearch/data elasticsearch:5.2.2-alpine To deploy them, I use the following commands: They are two nice containers ready to use. I’m also using Docker containers to run Moloch and ElasticSearch because they can be quickly deployed to investigate any PCAP even while on the road. It is a very good candidate to achieve this task: It helps you to capture traffic (optional), store/index flows in a database (at large scale because based on ElasticSearch) and, of course, search them. I tested multiple tools but my favourite one remains: Moloch. The next step is to have a tool ready to use to inspect the network traffic at any time. It’s nice to capture all the traffic in PCAP files but then? PCAP files are not convenient to process and they consume a lot of disk space (depending on the captured traffic of course).
Approximatively one year ago, I wrote a quick diary to explain how to implement a simple FPC or “Full Packet Capture” solution based on a Docker container. If you’re lucky, you’ll have access to a network capture.
Note 3: Xmas Tree: URG, PUSH, and FIN.When you are investigating a security incident, there are chances that, at a certain point, you will have to dive into network traffic analysis.
0 kommentar(er)
