How to run slips on Apple Silicon

Ondjultomte commented 1 year ago

Describe the bug crashes running against a pcap on apple silicon.

To Reproduce just run it with docker run -it --rm --net=host --name slips2 -v $(pwd)/dataset:/StratosphereLinuxIPS/dataset stratosphereips/slips:latest

on apple m1 macbook, so apple silicon

Expected behavior A clear and concise description of what you expected to happen.

Screenshots

`@linuxkit-6a8162938e55:/StratosphereLinuxIPS# ./slips.py -c config/slips.conf -f dataset/carina_00007_20231107144105.pcap [Main] Storing Slips logs in output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/ Slips. Version 1.0.7 (822db6d7) https://stratosphereips.org

[Main] Using redis server on port: 6379 Started Main process [PID 33] Started Output Process [PID 65] Starting modules Starting the module Risk IQ (Module to get passive DNS info about IPs from RiskIQ) [PID 95] Starting the module ARP (Detect arp attacks) [PID 97] Starting the module Flow Alerts (Alerts about flows: long connection, successful ssh, password guessing, self-signed certificate, data exfiltration, etc.) [PID 100] Starting the module Flow ML Detection (Train or test a Machine Learning model to detect malicious flows) [PID 103] Starting the module HTTP Analyzer (Analyze HTTP flows) [PID 106] Starting the module IP Info (Get different info about an IP/MAC address) [PID 108] Starting the module Leak Detector (Detect leaks of data in the traffic) [PID 116] Starting the module Network Discovery (Detect Horizonal, Vertical Port scans, ICMP, and DHCP scans) [PID 120] Starting the module Threat Intelligence (Check if the source IP or destination IP are in a malicious list of IPs) [PID 126] Starting the module Timeline (Creates kalipso timeline of what happened in the network based on flows and available data) [PID 129] Starting the module Update Manager (Update Threat Intelligence files) [PID 135] Starting the module Virustotal (IP, domain and file hash lookup on Virustotal) [PID 141]

[Main] Disabled Modules: ['template', 'ensembling', 'rnnccdetection', 'Exporting Alerts', 'p2ptrust', 'CESNET', 'blocking', 'CYST'] [Evidence] Storing Slips logs in output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/ Started Evidence Process [PID 143] Started Profiler Process [PID 145] [Main] Metadata added to output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/metadata Started Input Process [PID 147] [Main] Warning: Slips may generate a large amount of traffic by querying TI sites. [Input] Storing zeek log files in output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/zeek_files Total analyzed IPs so far: 0. Evidence added: 0. IPs sending traffic in the last 1 hr: 0. (2023/11/10 08:07:37)

Stopping Slips

[Main] Analysis of dataset/carina_00007_20231107144105.pcap finished in 0.70 minutes Flow Alerts Stopped. 13 left. Network Discovery Stopped. 12 left. Timeline Stopped. 11 left. IP Info Stopped. 10 left. Leak Detector Stopped. 9 left. Threat Intelligence Stopped. 8 left. HTTP Analyzer Stopped. 7 left. ARP Stopped. 6 left. Flow ML Detection Stopped. 5 left.

[Main] The following modules are busy working on your data.

['Update Manager', 'Evidence', 'Profiler', 'Input', 'Output']

You can wait for them to finish, or you can press CTRL-C again to force-kill.

[Main] Update Manager may take several minutes to finish updating 45+ TI files. Traceback (most recent call last): File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 559, in connect sock = self._connect() File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 615, in _connect raise err File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 603, in _connect sock.connect(socket_address) ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/StratosphereLinuxIPS/modules/update_manager/update_manager.py", line 563, in update_TI_file self.delete_old_source_data_from_database(file_name_to_download) File "/StratosphereLinuxIPS/modules/update_manager/update_manager.py", line 713, in delete_old_source_data_from_database self.delete_old_source_IPs(data_file) File "/StratosphereLinuxIPS/modules/update_manager/update_manager.py", line 683, in delete_old_source_IPs all_data = self.db.get_IPs_in_IoC() File "/StratosphereLinuxIPS/slips_files/core/database/database_manager.py", line 454, in get_IPs_in_IoC return self.rdb.get_IPs_in_IoC(*args, kwargs) File "/StratosphereLinuxIPS/slips_files/core/database/redis_db/ioc_handler.py", line 140, in get_IPs_in_IoC return self.rcache.hgetall('IoC_ips') File "/usr/local/lib/python3.8/dist-packages/redis/client.py", line 3014, in hgetall return self.execute_command('HGETALL', name) File "/usr/local/lib/python3.8/dist-packages/redis/client.py", line 898, in execute_command conn = self.connection or pool.get_connection(command_name, options) File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 1192, in get_connection connection.connect() File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 563, in connect raise ConnectionError(self._error_message(e)) redis.exceptions.ConnectionError: Error 111 connecting to localhost:6379. Connection refused. Traceback (most recent call last): File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 559, in connect sock = self._connect() File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 615, in _connect raise err File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 603, in _connect sock.connect(socket_address) ConnectionRefusedError: [Errno 111] Connection refused