search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
109 stars 4.93k forks source link

Add support for sniffing L2GRE encapsulated traffic to Packetbeat #7462

Open GitSweendog opened 6 years ago

GitSweendog commented 6 years ago

We've used Packetbeat for many purposes, and appreciate the ability to generate JSON data directly off the wire. Normally, we can place a network sniffer running beats right on a system connected to a span or tap to get the data we need, but in some cases, we want to use a remote sensor.

Several switch, router, and network aggregation and monitoring equipment (Gigamon, Cisco, Aruba etc.) can transmit locally monitored traffic over a layer 2 transport GRE tunnel. Essentially, a GRE connection is nailed up between the local system (Sniffer, Gigamon, etc.) and all traffic seen on the monitor port is encapsulated in GRE and sent up to the remote host.

The entire layer two (Ethernet) packets are included in the tunnel, so all that should need be done is to strip or ignore the first 37 bytes of data, which will expose a full frame. Then Packetbeat could work as normal when reassembling flows and decoding the protocol traffic.

Below is a screenshot of a Wireshark dissection of a sample DNS query encapsulated in GRE.

image

botelastic[bot] commented 4 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

rwaweber commented 4 years ago

Any thoughts on this Elastic folks? Would rather not have this issue auto-closed because of a lack of response

GitSweendog commented 4 years ago

I second that.

elasticmachine commented 3 years ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

Zeal0us commented 2 years ago

This would be super useful. Having this in telecom networks sending SIP off to elastic would be pretty great.

cductive commented 1 year ago

Any updates on this issue. I've got a similar problem where I have raw data being sent to elastic over a GRE tunnel, but have no way of getting the data processed in Elastic. Would standing up a server in between running Packetbeat resovle this issue?

3wjs commented 1 year ago

watching

elasticmachine commented 9 months ago

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)