Skip to content

Latest commit

 

History

History
30 lines (23 loc) · 883 Bytes

README.md

File metadata and controls

30 lines (23 loc) · 883 Bytes
Raw

traffic-feature-extractor

Extracting Traffic Features with Zeek

setup

  1. Create a docker image.
$ docker build --build-arg ZEEK_VERSION=4.0.1 --build-arg LIBRDKAFKA_VERSION=1.4.2 -t traffic-feature-extractor .
  1. Check that the plugin is installed in the container.
$ docker run --rm -it traffic-feature-extractor /bin/bash
$ zeek -N Seiso::Kafka
  1. Run a script to capture traffic.

for mac

$ docker run --add-host=localhost:<host private address> -e CAPTURE_INTERFACE=<network interface to capture> -e CAPTURE_PORT=<port on which kafka broker is running> --rm -it traffic-feature-extractor /bin/bash

zeek -j -C extractor.zeek

for linux

$ docker run --net=host -e CAPTURE_INTERFACE=<network interface to capture> -e CAPTURE_PORT=<port on which kafka broker is running> --rm -it traffic-feature-extractor /bin/bash

zeek -j -C extractor.zeek