Open dopheide-esnet opened 1 year ago
Looking at this again, I think it's just confusing terminology maybe? There IS something listening on port 2151, but I think what's happening is that zeek-client is talking to the agent process of the controller node, and that's on 2149. But then I still don't know what redef'ing Management::Controller::listen_address_websocket does because even if I set that to an IPv6 address, the listener is here: tcp 0 0 0.0.0.0:2151 0.0.0.0:* LISTEN
This isn't a problem other than causing confusion. The controller listens on 2050 (legacy) and 2049 (websockets), but is reported as listening on 2151. Looking at the data structure it looks like zeek-client is just outputting the result handed back to it.
This looks to be the data sent back to the client from the controller itself.