open port 57012

[jvlavl]

Hello

I have Malcolm running on ubuntu 22.04 but I want to add the polarproxy to the environment

the procedure that I followed is at https://www.netresec.com/?page=Blog&month=2020-12&post=Capturing-Decrypted-TLS-Traffic-with-Arkime

In the docker container /opt/malcolm/etc/config.ini I did change pcapReadMethod=tpacketv3 to pcapReadMethod=pcap-over-ip-server

Also in config.v2.json I added the portnumber and restarted the complete docker instance.

restarted the container

but still port 57012 is not listening

State                         Recv-Q                     Send-Q                                           Local Address:Port                                              Peer Address:Port                      Process
LISTEN                        0                          65535                                                127.0.0.1:9200                                                   0.0.0.0:*
LISTEN                        0                          4096                                                 127.0.0.1:27761                                                  0.0.0.0:*
LISTEN                        0                          4096                                                 127.0.0.1:27762                                                  0.0.0.0:*
LISTEN                        0                          4096                                                 127.0.0.1:27763                                                  0.0.0.0:*
LISTEN                        0                          4096                                                 127.0.0.1:27764                                                  0.0.0.0:*
LISTEN                        0                          4096                                                 127.0.0.1:27765                                                  0.0.0.0:*
LISTEN                        0                          65535                                                  0.0.0.0:10080                                                  0.0.0.0:*
LISTEN                        0                          65535                                                127.0.0.1:5044                                                   0.0.0.0:*
LISTEN                        0                          65535                                                127.0.0.1:5045                                                   0.0.0.0:*
LISTEN                        0                          65535                                                  0.0.0.0:443                                                    0.0.0.0:*
LISTEN                        0                          128                                                    0.0.0.0:22                                                     0.0.0.0:*
LISTEN                        0                          65535                                                127.0.0.1:8022                                                   0.0.0.0:*
LISTEN                        0                          65535                                                  0.0.0.0:10443                                                  0.0.0.0:*

Kind regards

John

[mmguero]

I'm sorry, I don't have any experience using polarproxy, and I'm not sure whether or not what you're trying to do is going to work with how malcolm uses its arkime containers.

Malcolm has got two arkime containers, one is arkime which processes PCAP files that are either 1) uploaded through the arkime upload interface or 2) periodically processed "live" PCAP captured by tcpdump or netsniff-ng rolled over every so many minutes or megabytes. The other container is the arkime-live which runs capture on live traffic, but this can only be used when running a remote opensearch or elastic instance, not Malcolm's internally managed one.

In either case, this entrypoint script is used to generate Arkime's config.ini using environment variables using a file docker bind-mounted as /opt/arkime/etc/config.orig.ini as a basis. You could add a line like - ./arkime/etc/config.ini:/opt/arkime/etc/config.orig.ini:ro into the volumes section of the arkime-live container, but again, it's only going to be running that container if you're using an external opensearch or elasticsearch instance. As far as ports being open, you'd have to specify that in the ports section for the appropriate container as well.

I'm going to close this bug as it's not going to be a supported configuration for us to help you out with, but good luck and I hope you can figure out a way to do what you're trying to do.