How to run slips on Apple Silicon #411

Ondjultomte · 2023-11-10T08:16:03Z

Describe the bug
crashes running against a pcap on apple silicon.

To Reproduce
just run it with
docker run -it --rm --net=host --name slips2 -v $(pwd)/dataset:/StratosphereLinuxIPS/dataset stratosphereips/slips:latest

on apple m1 macbook, so apple silicon

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots

`@linuxkit-6a8162938e55:/StratosphereLinuxIPS# ./slips.py -c config/slips.conf -f dataset/carina_00007_20231107144105.pcap
[Main] Storing Slips logs in output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/
Slips. Version 1.0.7 (`822db6d`)
https://stratosphereips.org

[Main] Using redis server on port: 6379
Started Main process [PID 33]
Started Output Process [PID 65]
Starting modules
Starting the module Risk IQ (Module to get passive DNS info about IPs from RiskIQ) [PID 95]
Starting the module ARP (Detect arp attacks) [PID 97]
Starting the module Flow Alerts (Alerts about flows: long connection, successful ssh, password guessing, self-signed certificate, data exfiltration, etc.) [PID 100]
Starting the module Flow ML Detection (Train or test a Machine Learning model to detect malicious flows) [PID 103]
Starting the module HTTP Analyzer (Analyze HTTP flows) [PID 106]
Starting the module IP Info (Get different info about an IP/MAC address) [PID 108]
Starting the module Leak Detector (Detect leaks of data in the traffic) [PID 116]
Starting the module Network Discovery (Detect Horizonal, Vertical Port scans, ICMP, and DHCP scans) [PID 120]
Starting the module Threat Intelligence (Check if the source IP or destination IP are in a malicious list of IPs) [PID 126]
Starting the module Timeline (Creates kalipso timeline of what happened in the network based on flows and available data) [PID 129]
Starting the module Update Manager (Update Threat Intelligence files) [PID 135]
Starting the module Virustotal (IP, domain and file hash lookup on Virustotal) [PID 141]

[Main] Disabled Modules: ['template', 'ensembling', 'rnnccdetection', 'Exporting Alerts', 'p2ptrust', 'CESNET', 'blocking', 'CYST']
[Evidence] Storing Slips logs in output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/
Started Evidence Process [PID 143]
Started Profiler Process [PID 145]
[Main] Metadata added to output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/metadata
Started Input Process [PID 147]
[Main] Warning: Slips may generate a large amount of traffic by querying TI sites.
[Input] Storing zeek log files in output/carina_00007_20231107144105.pcap_2023-11-10_08:06:54/zeek_files
Total analyzed IPs so far: 0. Evidence added: 0. IPs sending traffic in the last 1 hr: 0. (2023/11/10 08:07:37)

Stopping Slips

[Main] Analysis of dataset/carina_00007_20231107144105.pcap finished in 0.70 minutes
Flow Alerts Stopped. 13 left.
Network Discovery Stopped. 12 left.
Timeline Stopped. 11 left.
IP Info Stopped. 10 left.
Leak Detector Stopped. 9 left.
Threat Intelligence Stopped. 8 left.
HTTP Analyzer Stopped. 7 left.
ARP Stopped. 6 left.
Flow ML Detection Stopped. 5 left.

[Main] The following modules are busy working on your data.

['Update Manager', 'Evidence', 'Profiler', 'Input', 'Output']

You can wait for them to finish, or you can press CTRL-C again to force-kill.

[Main] Update Manager may take several minutes to finish updating 45+ TI files.
Traceback (most recent call last):
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 559, in connect
sock = self._connect()
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 615, in _connect
raise err
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 603, in _connect
sock.connect(socket_address)
ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/StratosphereLinuxIPS/modules/update_manager/update_manager.py", line 563, in update_TI_file
self.delete_old_source_data_from_database(file_name_to_download)
File "/StratosphereLinuxIPS/modules/update_manager/update_manager.py", line 713, in delete_old_source_data_from_database
self.delete_old_source_IPs(data_file)
File "/StratosphereLinuxIPS/modules/update_manager/update_manager.py", line 683, in delete_old_source_IPs
all_data = self.db.get_IPs_in_IoC()
File "/StratosphereLinuxIPS/slips_files/core/database/database_manager.py", line 454, in get_IPs_in_IoC
return self.rdb.get_IPs_in_IoC(*args, **kwargs)
File "/StratosphereLinuxIPS/slips_files/core/database/redis_db/ioc_handler.py", line 140, in get_IPs_in_IoC
return self.rcache.hgetall('IoC_ips')
File "/usr/local/lib/python3.8/dist-packages/redis/client.py", line 3014, in hgetall
return self.execute_command('HGETALL', name)
File "/usr/local/lib/python3.8/dist-packages/redis/client.py", line 898, in execute_command
conn = self.connection or pool.get_connection(command_name, **options)
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 1192, in get_connection
connection.connect()
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 563, in connect
raise ConnectionError(self._error_message(e))
redis.exceptions.ConnectionError: Error 111 connecting to localhost:6379. Connection refused.
Traceback (most recent call last):
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 559, in connect
sock = self._connect()
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 615, in _connect
raise err
File "/usr/local/lib/python3.8/dist-packages/redis/connection.py", line 603, in _connect
sock.connect(socket_address)
ConnectionRefusedError: [Errno 111] Connection refused