Error with zeekctl netstats command
Jorge Garcia Rodriguez <[email protected]> Wed, 11 Dec 2019 11:29:54 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
--===============2019667078== Content-Language: es-ES Content-Type: multipart/alternative; boundary="_000_D6E3E7F0075CEF4CB16D0A627912409A35E0B6BDGalileosiaes_" --_000_D6E3E7F0075CEF4CB16D0A627912409A35E0B6BDGalileosiaes_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi everyone Im facing the next error whenever I try to use the command "zeekctl netstat= s" to check the packets dropped. worker-1-1: <error: Python bindings for Broker: No module named ipaddress> And this with every other worker in 2 of 4 zeeks that we have deployed. I have other 2 nodes in which this command run without any problem and all = the machines has been installed following the same procedure. Also this 2 n= odes in which the command runs well, don't receive any traffic at this mome= nt. So I don't know if this is something that we missed in the installation or = is something produced by the amount of traffic. Hope you can help me to resolve this issue. Thanks you all! Regards. Jorge Garc=EDa Rodr=EDguez Technical Consultant Security Infrastructures [email protected]<mailto:[email protected]> Grupo SIA Avda.Europa,2 - Alcor Plaza, Edificio B - Parque Oeste Alcorc=F3n 28922 Alcorc=F3n - Madrid Tlf: +34 902 480 580<nxphone:+34%20902%20480%20580> Fax: +34 91 307 79 80= <nxphone:+34%2091%20307%2079%2080> www.siainternational.com<http://www.siainternational.com/> delivering value This e-mail and any attached files are intended solely for the addresse/s i= dentified herein. It may contain confidential and/or legally privileged inf= ormation and may not necessarily represent the opinion of SIA. No legally binding commitments will be created by this E-mail message. Wher= e we intend to create legally binding commitments these will be made throug= h hard copy correspondence or documents. If you receive this message by mis= take, please immediately notify the sender and delete it since you are not = authorized to use, disclose, distribute, print or copy all or part of the c= ontained information Thank you. It is understood that the message was sent = to you accidentally, although you appear as the addressee, you can see from= the frame of existing relations that you were not the final addressee. --_000_D6E3E7F0075CEF4CB16D0A627912409A35E0B6BDGalileosiaes_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <meta name=3D"Generator" content=3D"Microsoft Word 14 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif"; mso-fareast-language:EN-US;} a:link, span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;} span.EstiloCorreo17 {mso-style-type:personal-compose; font-family:"Calibri","sans-serif"; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri","sans-serif"; mso-fareast-language:EN-US;} @page WordSection1 {size:612.0pt 792.0pt; margin:70.85pt 3.0cm 70.85pt 3.0cm;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"ES" link=3D"blue" vlink=3D"purple"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Hi everyone<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Im facing the next error whenev= er I try to use the command “<i>zeekctl netstats”</i> to check = the packets dropped.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">worker-1-1: <error: Python b= indings for Broker: No module named ipaddress><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">And this with every other worke= r in 2 of 4 zeeks that we have deployed.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">I have other 2 nodes in which t= his command run without any problem and all the machines has been installed= following the same procedure. Also this 2 nodes in which the command runs = well, don’t receive any traffic at this moment. <o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">So I don’t know if this i= s something that we missed in the installation or is something produced by = the amount of traffic.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Hope you can help me to resolve= this issue.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Thanks you all!<o:p></o:p></spa= n></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US">Regards.<o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:10.0pt;fo= nt-family:"Verdana","sans-serif";color:#0099CA;mso-fare= ast-language:ES">Jorge Garc=EDa Rodr=EDguez</span></b><span lang=3D"EN-US" = style=3D"font-size:7.5pt;font-family:"Verdana","sans-serif&q= uot;;color:black;mso-fareast-language:ES"><br> </span><span lang=3D"EN-US" style=3D"font-size:7.5pt;font-family:"Verd= ana","sans-serif";color:#0099CA;mso-fareast-language:ES">Tec= hnical Consultant<br> Security Infrastructures<br> </span><span style=3D"font-size:7.5pt;font-family:"Verdana","= ;sans-serif";color:black;mso-fareast-language:ES"><a href=3D"mailto:jg= [email protected]"><span lang=3D"EN-US" style=3D"color:blue">[email protected]</s= pan></a></span><span lang=3D"EN-US" style=3D"color:black;mso-fareast-langua= ge:ES"><o:p></o:p></span></p> <p class=3D"MsoNormal"><b><span style=3D"font-size:10.0pt;font-family:"= ;Verdana","sans-serif";color:gray;mso-fareast-language:ES">G= rupo SIA</span></b><span style=3D"font-size:7.5pt;font-family:"Verdana= ","sans-serif";color:#0099CA;mso-fareast-language:ES"><br> </span><span style=3D"font-size:7.5pt;font-family:"Verdana","= ;sans-serif";color:gray;mso-fareast-language:ES">Avda.Europa,2 - Alcor= Plaza, Edificio B - Parque Oeste Alcorc=F3n</span><span style=3D"font-size= :7.5pt;font-family:"Verdana","sans-serif";color:#0099CA= ;mso-fareast-language:ES"><br> </span><span style=3D"font-size:7.5pt;font-family:"Verdana","= ;sans-serif";color:gray;mso-fareast-language:ES">28922 Alcorc=F3n - Ma= drid</span><span style=3D"font-size:7.5pt;font-family:"Verdana",&= quot;sans-serif";color:#0099CA;mso-fareast-language:ES"><br> </span><span style=3D"font-size:7.5pt;font-family:"Verdana","= ;sans-serif";color:gray;mso-fareast-language:ES">Tlf: <a href=3D"= nxphone:+34%20902%20480%20580"><span style=3D"color:blue">+34 902 4= 80 580</span></a> Fax: <a href=3D"nxphone:+34%2091%203= 07%2079%2080"><span style=3D"color:blue">+34 91 307 79 80</span></a></span><span style=3D"font-size:7.5pt;font-family:&= quot;Verdana","sans-serif";color:#0099CA;mso-fareast-languag= e:ES"><br> </span><span style=3D"color:black;mso-fareast-language:ES"><a href=3D"http:= //www.siainternational.com/" target=3D"_BLANK" title=3D"http://www.siainter= national.com/"><span style=3D"font-size:7.5pt;font-family:"Verdana&quo= t;,"sans-serif";color:blue">www.siainternational.com</span></a><o= :p></o:p></span></p> <p class=3D"MsoNormal"><b><span lang=3D"EN-US" style=3D"font-size:7.5pt;fon= t-family:"Verdana","sans-serif";color:gray;mso-fareast-= language:ES">delivering value<o:p></o:p></span></b></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:7.5pt;font-f= amily:"Times New Roman","serif";color:gray;mso-fareast-= language:ES">This e-mail and any attached files are intended solely for the= addresse/s identified herein. It may contain confidential and/or legally privileged information and may not necessarily represent th= e opinion of SIA. </span><span lang=3D"EN-US" style=3D"mso-fareast-language:ES"><o:p></o:p></= span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"font-size:7.5pt;font-f= amily:"Times New Roman","serif";color:gray;mso-fareast-= language:ES">No legally binding commitments will be created by this E-mail = message. Where we intend to create legally binding commitments these will be made through hard copy correspondence or documents. If you r= eceive this message by mistake, please immediately notify the sender and de= lete it since you are not authorized to use, disclose, distribute, print or= copy all or part of the contained information Thank you. It is understood that the message was sent to you a= ccidentally, although you appear as the addressee, you can see from the fra= me of existing relations that you were not the final addressee.</span><span= lang=3D"EN-US" style=3D"mso-fareast-language:ES"><o:p></o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US" style=3D"color:black;mso-fareas= t-language:ES"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span lang=3D"EN-US"><o:p> </o:p></span></p> </div> </body> </html> --_000_D6E3E7F0075CEF4CB16D0A627912409A35E0B6BDGalileosiaes_-- --===============2019667078== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============2019667078==--