alphasoc / nfr

A lightweight tool to score network traffic and flag anomalies
https://alphasoc.com
Other
122 stars 19 forks source link

Packet capture doesn't work #29

Closed ioj closed 7 years ago

ioj commented 7 years ago

I'd provide a more verbose bug report, but namescore listen just sits there silently and doesn't produce any logs.

phob0s-pl commented 7 years ago

Can you show what is in syslog ?

ioj commented 7 years ago

I tailed syslog and restarted the daemon. This is the output:

Feb 28 12:46:41 biuro namescore/listen[19980]: #033[32mINFO#033[0m[02-28|12:46:41] Stopped retrieving alerts.
Feb 28 12:46:41 biuro namescore/listen[19980]: #033[32mINFO#033[0m[02-28|12:46:41] Stopped sending queries.
Feb 28 12:46:41 biuro namescore/listen[19980]: #033[32mINFO#033[0m[02-28|12:46:41] Stopped sending queries.
Feb 28 12:46:43 biuro namescore/listen[19980]: #033[32mINFO#033[0m[02-28|12:46:43] namescore exitting                       #033[32msignal#033[0m=interrupt
Feb 28 12:46:45 biuro namescore/listen[24965]: #033[32mINFO#033[0m[02-28|12:46:45] Whitelist error                          #033[32merr#033[0m="open /home/phob0s/alphasoc/whitelist.toml: no such file or directory"
Feb 28 12:46:45 biuro namescore/listen[24965]: #033[32mINFO#033[0m[02-28|12:46:45] namescore daemon started                 #033[32mversion#033[0m=0.1
ioj commented 7 years ago

I also noticed that: 1) coloring doesn't work in syslog 2) there's some kind of problem with whitelists.

phob0s-pl commented 7 years ago

1). So I will change log15 format to different one. If you have there systemd colors are present in journalctl. 2) It's INFO log informing that there is no whitelist file ( it's not mandatory file )

phob0s-pl commented 7 years ago

If you have still default settings: 1) run namescore listen 2) run in bash loop "nslookup google.pl" 101 times 3) check if there is dump in /home/phob0s/alphasoc/backup

ioj commented 7 years ago

Done, but the directory is empty.

phob0s-pl commented 7 years ago

in offline discussion it turned out that its working, debugus helped