Re: Zeek + PF_Ring Issue
Jorge García Rodríguez <[email protected]> Thu, 19 Dec 2019 15:55:47 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <AM0PR07MB421046FD5A13395E0FAE6B7BEB520@AM0PR07MB4210.eurprd07.prod.outlook.com> |
--===============1492951648== Content-Language: es-ES Content-Type: multipart/alternative; boundary="_000_AM0PR07MB421046FD5A13395E0FAE6B7BEB520AM0PR07MB4210eurp_" --_000_AM0PR07MB421046FD5A13395E0FAE6B7BEB520AM0PR07MB4210eurp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Enviado desde Outlook<http://aka.ms/weboutlook> ________________________________ De: Justin Azoff <[email protected]> Enviado: jueves, 19 de diciembre de 2019 16:06 Para: Jorge Garc=EDa Rodr=EDguez <[email protected]> Cc: [email protected] <[email protected]> Asunto: Re: [Zeek] Zeek + PF_Ring Issue Thank you for your reply Also doing a further investigation it seems that the script that is overcha= rguing the cpu is the weird.zeek =BFIs there a way to disable this script? Do you say that because you have a lot of entries in the weird log? that p= oints to traffic issues that need to be fixed... disabling the weird logs w= ill just ignore the problem. What are the top weirds that you are seeing? cat /usr/local/zeek/logs/current/weird.log |zeek-cut name|sort|uniq -c= |sort -rn I have 160167 entries in like 10 minutes. After 20 mins I have a total of 329572 entries and 245954 of them are bad_H= TTP_request What did you see as the result from this check? # Checking if many recent connections have a SAD or had history ################################################################# # Checking if many recent connections have a SAD or had history # ################################################################# error: 52.91%, 33795 out of 63873 connections are half duplex Best Regards! -- Jorge --_000_AM0PR07MB421046FD5A13395E0FAE6B7BEB520AM0PR07MB4210eurp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);"> <br> </div> <div id=3D"Signature"> <div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt; color:#000000; ba= ckground-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif"> Enviado desde <a href=3D"http://aka.ms/weboutlook">Outlook</a></div> <div> <div id=3D"appendonsend"></div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <br> </div> <hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" co= lor=3D"#000000" style=3D"font-size:11pt"><b>De:</b> Justin Azoff <justin= @corelight.com><br> <b>Enviado:</b> jueves, 19 de diciembre de 2019 16:06<br> <b>Para:</b> Jorge Garc=EDa Rodr=EDguez <[email protected]>= <br> <b>Cc:</b> [email protected] <[email protected]><br> <b>Asunto:</b> Re: [Zeek] Zeek + PF_Ring Issue</font> <div> </div> </div> <div> <div dir=3D"ltr"> <div dir=3D"ltr">Thank you for your reply</div> <div class=3D"x_gmail_quote"> <div><br> </div> <div> </div> <blockquote class=3D"x_gmail_quote" style=3D"margin:0px 0px 0px 0.8ex; bord= er-left:1px solid rgb(204,204,204); padding-left:1ex"> <div dir=3D"ltr"> <div id=3D"x_gmail-m_8854684454924686212Signature"> <div> <div style=3D"font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> <div>Also doing a further investigation it seems that the script that is ov= ercharguing the cpu is the weird.zeek =BFIs there a way to disable this scr= ipt?</div> </div> </div> </div> </div> </blockquote> <div><br> </div> <div>Do you say that because you have a lot of entries in the weird log?&nb= sp; that points to traffic issues that need to be fixed... disabling the we= ird logs will just ignore the problem. What are the top weirds that y= ou are seeing?</div> <div><br> </div> <div> cat /usr/local/zeek/logs/current/weird.log |zeek-cu= t name|sort|uniq -c|sort -rn</div> <div><br> </div> <div>I have <span>160167 entries in like 10 minutes.</span></div> <div><span><br> </span></div> <div><span>After 20 mins I have a total of 329572 entries and <span>24= 5954 of them are bad_HTTP_request<br> </span><span></span></span></div> <div><br> </div> <div>What did you see as the result from this check?</div> <div><br> </div> <div># Checking if many recent connections have a SAD or had history</div> <div><br> </div> <div><span>################################################################= #<br> </span> <div># Checking if many recent connections have a SAD or had history #<br> </div> <div>#################################################################<br> </div> <div>error: 52.91%, 33795 out of 63873 connections are half duplex<br> </div> <span></span><br> </div> <div><br> </div> <div>Best Regards!</div> <div><br> </div> <div>--</div> <div>Jorge</div> </div> <div dir=3D"ltr" class=3D"x_gmail_signature"></div> </div> </div> </div> </div> </body> </html> --_000_AM0PR07MB421046FD5A13395E0FAE6B7BEB520AM0PR07MB4210eurp_-- --===============1492951648== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1492951648==--