CentOS7下部署开源网络流量回溯分析系统Moloch
Moloch 是一个由AOL开源的，能够大规模的捕获IPv4数据包(PCAP)、索引和数据库系统，由以下三个部分组成：
1）capture ：绑定interface运行的单线程C语言应用
2）viewer ：运行在capture主机上的node.js web应用
3）elasticsearch : moloch的数据检索驱动
1、下载Moloch CentOS7版本的RPM包
https://s3.amazonaws.com/files.molo.ch/builds/centos-7/moloch-2.4.0-1.x86_64.rpm
另外下载elasticsearch Linux系统的RPM包
https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.9.1-x86_64.rpm
2、上传jdk，配置jdk环境变量
tar -zxvf jdk-8u261-linux-x64.tar.gz -C /usr/local/ cd /usr/local/ mv jdk1.8.0_261 jdk echo "export JAVA_HOME=/usr/local/jdk" >> /etc/profile.d/java8.sh echo "export PATH=\$PATH:\$JAVA_HOME/bin" >> /etc/profile.d/java8.sh echo "export CLASSPATH=.:\$JAVA_HOME/jre/lib:\$JAVA_HOME/lib:\$JAVA_HOME/lib/tools.jar" >> /etc/profile.d/java8.sh source /etc/profile.d/java8.sh
3、安装并配置elasticsearch
1)调整JVM内存大小
cd /opt/ rpm -ivh elasticsearch-7.9.1-x86_64.rpm cd /etc/elasticsearch/ vi jvm.options
2)修改elasticsearch配置文件
cd /data mkdir /data/elasticsearch mkdir -p /data/log/elasticsearch chown -R elasticsearch:elasticsearch elasticsearch chown -R elasticsearch:elasticsearch log
vi /etc/elasticsearch/elasticsearch.yml #修改如下几个地方 path.data: /data/elasticsearch path.logs: /data/log/elasticsearch network.host:10.20.90.46 http.port:9200 discovery.seed_hosts: ["10.20.90.46"]
3)启动elasticsearch
systemctl daemon-reload systemctl enable elasticsearch.service systemctl start elasticsearch.service
最后可以curl http://IP:9200测试服务是否正常运行
4、安装Moloch
yum localinstall moloch-2.4.0-1.x86_64.rpm
5、Moloch初始化配置
cd /data/moloch/bin ./Configure
选择需要监控的网卡 也就是你的镜像流量对应的网卡
/data/moloch/db/db.pl http://10.20.90.46:9200 init
出现如下报错时 Couldn't GET http://10.20.90.46:9200/_cluster/health the http status code is 503 are you sure elasticsearch is running/reachable? at /data/moloch/db/db.pl line 277.
解决办法如下
vi /etc/elasticsearch/elasticsearch.yml 修改配置文件如下行，配置node.name及cluster.initial_master_nodes，然后重启elasticsearch node.name: es-node cluster.initial_master_nodes: ["es-node"] systemctl restart elasticsearch.service
继续初始化配置
/data/moloch/bin/moloch_add_user.sh admin "Admin User" admin --admin systemctl start molochcapture.service systemctl start molochviewer.service netstat -anp | grep 8005
6、web登录并体验Moloch
http://IP:8005，密码为之前的初始化时设置的密码
具体使用帮助可以点击猫头鹰头像
7、开启镜像网卡的混杂模式
ifconfig ens33 promisc
本文参考如下链接完成
https://www.jianshu.com/p/a01522c6fe58https://paper.seebug.org/427/
