Ports for workers
Scot Harris <[email protected]> Thu, 5 Dec 2019 14:19:28 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <SN6PR0901MB2480B03510CE5F59483D695AA95C0@SN6PR0901MB2480.namprd09.prod.outlook.com> |
--===============0708576803== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_SN6PR0901MB2480B03510CE5F59483D695AA95C0SN6PR0901MB2480_" --_000_SN6PR0901MB2480B03510CE5F59483D695AA95C0SN6PR0901MB2480_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Have two machines, one running manager, logger, proxy, worker. Second machine running worker. Cluster appears to be working. However, some of the commands in zeekctl hang. (peerstatus, netstats) Appears to be due to firewall on the second machine. Disabling firewall th= e commands work as expected. What ports on the second machine need to be opened? I found ports for: Logger 47761 Manager 47762 Proxy 47763 Thank you. __________________________________________ Scot Harris Network Engineer City of Hollywood Information Technology P.O. Box 229045 Hollywood, FL 33022-9045 Office: 954-921-3304 E-mail: [email protected] [www.hollywoodfl.org] Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record. __________________________________________ --_000_SN6PR0901MB2480B03510CE5F59483D695AA95C0SN6PR0901MB2480_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:m=3D"http://schema= s.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html= 40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Have two machines, one running manager, logger, prox= y, worker.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Second machine running worker.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Cluster appears to be working.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">However, some of the commands in zeekctl hang. = (peerstatus, netstats)<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Appears to be due to firewall on the second machine.= Disabling firewall the commands work as expected.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">What ports on the second machine need to be opened?<= o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">I found ports for:<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Logger 47761<o:p></o:p></p> <p class=3D"MsoNormal">Manager 47762<o:p></o:p></p> <p class=3D"MsoNormal">Proxy 47763<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Thank you.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div style=3D"font-size:9pt; font-family: ''Gill Sans MT'',sans-serif;">__= ________________________________________<br> <i><b>Scot Harris</i></b><br> Network Engineer<br> City of Hollywood<br> Information Technology<br> <br> P.O. Box 229045<br> Hollywood, FL 33022-9045<br> Office: 954-921-3304<br> E-mail: [email protected]<br> <div><img alt=3D"www.hollywoodfl.org" src=3D"http://apps.hollywoodfl.org/im= ages/coh_logo_color.png"></div> Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record.<br> __________________________________________</div> </body> </html> --_000_SN6PR0901MB2480B03510CE5F59483D695AA95C0SN6PR0901MB2480_-- --===============0708576803== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0708576803==--