This plugin provides native NETMAP support for Zeek as a packet source.
This repository is derived from zeek/bro-netmap which is not actively maintained and doesn't support zeek. The difference between zeek-netmap and bro-netmap is some meta data.
Follow NETMAP's instructions to get its kernel module and, potentially, custom drivers installed. Then install this plugin through the Zeek Package Manager.
git clone https://github.com/WqyJh/zeek-netmap
zkg install ./zeek-netmapTo use NETMAP, Zeek needs read and write access to /dev/netmap. If you give that permission to a user, you can run Zeek as non-root.
Once installed, you can use NETMAP interfaces/ports by prefixing them with either netmap:: or vale:: on the command line. For example, to use NETMAP to monitor interface eth0.
zeek -i netmap::eth0Netmap does not enable promiscuous mode on interfaces, you'll have to do that yourself. For example, on Linux.
ifconfig eth0 promiscTo use it in production with multiple zeek processes, start an zeek cluster.
The cluster includes frontend and backend.
Run frontend with lb in the following way, which divide the traffic into 2 netmap pipes (adjust the number of pipes for your environment) named as zeek.
lb -i eth1 -p zeek:2Config the netmap workers for the cluster in node.cfg. lb_procs should equal to the number of zeek pipes. Here's an mininum config example.
[manager]
type=manager
host=localhost
[proxy-1]
type=proxy
host=localhost
[worker-1]
type=worker
host=localhost
lb_method=custom
lb_procs=2
interface=netmap::zeekUse zeekctl to start the cluster.
$ zeekctl
[ZeekControl] > install
[ZeekControl] > start
[ZeekControl] > exit
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent