Zeek Extensions

發佈日期: 作者:

常見的Extensions有：

  • PF_RING 提昇網路封包讀取效能
  • GeoIP 國家解析

 

PF_RING

下載

#cd /usr/src
#sudo wget https://github.com/ntop/PF_RING/archive/7.2.0-stable.zip
#sudo unzip 7.2.0-stable.zip

 

安裝

cd PF_RING-X.Y.Z-stable/userland/lib
sudo ./configure --prefix=/opt/pfring-X.Y.Z
sudo make
sudo make install

#cd ../libpcap
#sudo ./configure --prefix=/opt/pfring-X-Y-Z
#sudo make
#sudo make install

#cd ../tcpdump-A.B.C
#sudo ./configure --prefix=/opt/pfring-X-Y-Z
#sudo make
#sudo make install

#cd ../../kernel
#sudo make
#sudo make install

 

更新並重開

#sudo yum update
#sudo reboot

 

讀取pf_ring模組

#sudo modprobe pf_ring enable_tx_capture=0 min_num_slots=65534

 

檢視pf_ring模組資訊

#cat /proc/net/pf_ring/info
PF_RING Version : 7.2.0 (unknown)
Total rings : 0

Standard (non ZC) Options
Ring slots : 65534
Slot version : 17
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard
Cluster Fragment Queue : 0
Cluster Fragment Discard : 0

 

設定每次開機自動讀pf_ring模組

編輯/etc/modules-load.d/pf_ring.conf並加入以下資訊

# load pf_ring
pf_ring

編輯 /etc/modprobe.d/pf_ring.conf 並加入以下資訊

options pf_ring enable_tx_capture=0 min_num_slots=65534

 

重開機測試是否有自動讀入pf_ring模組

#sudo reboot
#cat /proc/net/pf_ring/info

PF_RING Version : 7.2.0 (unknown)
Total rings : 0

Standard (non ZC) Options
Ring slots : 65534
Slot version : 17
Capture TX : No [RX only]
IP Defragment : No
Socket Mode : Standard
Cluster Fragment Queue : 0
Cluster Fragment Discard : 0

 

GeoIP

安裝libmaxminddb

#sudo yum --enablerepo=extras install epel-release
#sudo yum install libmaxminddb-devel

 

下載GeoLite2 database

#wget http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz
#tar xzvf GeoLite2-City.tar.gz

 

將資料移到指定的位置

#sudo mv GeoLite2-City_YYYYMMDD/GeoLite2-City.mmdb /usr/share/GeoIP/GeoLite2-City.mmdb