zeek / zeek-client

Experimental implementation of Zeek's future cluster management client
BSD 3-Clause "New" or "Revised" License
4 stars 4 forks source link

get-nodes reports the wrong port for the controller #35

Open dopheide-esnet opened 1 year ago

dopheide-esnet commented 1 year ago

This isn't a problem other than causing confusion. The controller listens on 2050 (legacy) and 2049 (websockets), but is reported as listening on 2151. Looking at the data structure it looks like zeek-client is just outputting the result handed back to it.

zeek@zeek-test-cluster2:~$ zeek-client --controller zeek-test-cluster1.es.net:2149 get-nodes
{
  "errors": [],
  "results": {
    "agent-zeek-test-cluster1.es.net": {
      "agent-zeek-test-cluster1.es.net": {
        "cluster_role": null,
        "mgmt_role": "AGENT",
        "pid": 324435,
        "state": "RUNNING"
      },
      "controller-zeek-test-cluster1.es.net": {
        "cluster_role": null,
        "mgmt_role": "CONTROLLER",
        "pid": 324434,
        "port": 2151,
        "state": "RUNNING"
      }
    }
  }
}

This looks to be the data sent back to the client from the controller itself.

dopheide-esnet commented 1 week ago

Looking at this again, I think it's just confusing terminology maybe? There IS something listening on port 2151, but I think what's happening is that zeek-client is talking to the agent process of the controller node, and that's on 2149. But then I still don't know what redef'ing Management::Controller::listen_address_websocket does because even if I set that to an IPv6 address, the listener is here: tcp 0 0 0.0.0.0:2151 0.0.0.0:* LISTEN