- WLUG - wlug.mailman3.com

Re: Zeek - from yesterday's meeting

by Chuck Anderson

On Tue, Apr 13, 2021 at 09:16:10AM -0400, John Stoffel via WLUG wrote: > Now that I have zeek up and running... what's the best tool/process > for viewing the data? Looking at the hourly emailed logs is sorta > interesting, but honestly not a great way to see trends over time. I know people use $$$$$plunk (Splunk) for that sort of thing. Perhaps ELK (Elasticsearch, Logstash, and Kibana) would work. Oh look, someone has a recipe for how to do that: https://logz.io/blog/bro-elk-part-1/

April 13, 2021

Re: Zeek - from yesterday's meeting

by John Stoffel

Guys, Now that I have zeek up and running... what's the best tool/process for viewing the data? Looking at the hourly emailed logs is sorta interesting, but honestly not a great way to see trends over time. I've looked over the zeek.org website, and there's no real discussion there on how to summarize and get a good high level view of what's going on. Even just a daily report would be better, I think. So what I'm doing is setting up my core switch to mirror all the traffic between the switch and the router, while I also have the zeek box on another port on the switch for management. This seems to be working well so far, it's seeing all my traffic to/from the internet and the various devices connected. Cheers, John

April 13, 2021

Re: Zeek - from yesterday's meeting

by John Stoffel

>>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes: >> You missed a fun meeting last night. Jon> I am sure I did. Unfortunately I am in Rio de Janeiro and was Jon> tied up with another meeting. Have a great time down there. Brazil is definitely on my list of places to visit some day. Along with Argentina, Chile, Peru.... lots of places in the world to see still.

April 10, 2021

Re: Zeek - from yesterday's meeting

by Jon "maddog" Hall

>You missed a fun meeting last night. I am sure I did. Unfortunately I am in Rio de Janeiro and was tied up with another meeting. Warmest regards, maddog On Fri, Apr 9, 2021 at 7:21 PM John Stoffel <john(a)stoffel.org> wrote: > >>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes: > > Jon> From time to time I used a USB Ethernet port: > Jon> https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter > > I used to have one of those kicking around, but for now I'm going to > go with the APU2 dedicated hardware box, it should have enough oomph > once I get Debian Buster (10.10) installed on it. > > Jon> Generally they are about 25 USD. You might be able to find them > Jon> on Ebay or other places for less than that. You might as well > Jon> get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0 > Jon> will not support 1 Gbit/second, whereas USB 3.0 will. On the > Jon> other hand if the networking flow is not 1 Gbit/second then USB > Jon> 2.0 might work fine. > > Jon> I have found the Linux support for these generic USB Ethernet > Jon> devices to be generally good. > > Thanks for the feedback! You missed a fun meeting last night. > > Jon> md > > Jon> On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG < > wlug(a)lists.wlug.org> wrote: > > Jon> Guys, > Jon> I'm looking into Zeek and unfortunately I don't have a second > ethernet > Jon> port on my main system, so it's not clear how I'd run a span port > off > Jon> my main switch to grab traffic. > > Jon> What hardware do people recommend for a zeek data collection > node? I > Jon> guess I could spin up my old WRAP board (http://www.pcengines.ch) > Jon> which I used as my main router for years before I replaced it > Jon> recently. But it's not super fast. It's got three 1gb ports, and > 4gb > Jon> of RAM with a 1Ghz single core AMD CPU. So it might do the job, > esp > Jon> since I can install Debian Buster on there without too much > trouble. > Jon> Sweet! > > Jon> John > Jon> _______________________________________________ > Jon> WLUG mailing list -- wlug(a)lists.wlug.org > Jon> To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Jon> Create Account: https://wlug.mailman3.com/accounts/signup/ > Jon> Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Jon> Web Forum/Archive: > Jon> > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L… > >

April 9, 2021

Re: Zeek - from yesterday's meeting

by John Stoffel

>>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes: Jon> From time to time I used a USB Ethernet port: Jon> https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter I used to have one of those kicking around, but for now I'm going to go with the APU2 dedicated hardware box, it should have enough oomph once I get Debian Buster (10.10) installed on it. Jon> Generally they are about 25 USD. You might be able to find them Jon> on Ebay or other places for less than that. You might as well Jon> get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0 Jon> will not support 1 Gbit/second, whereas USB 3.0 will. On the Jon> other hand if the networking flow is not 1 Gbit/second then USB Jon> 2.0 might work fine. Jon> I have found the Linux support for these generic USB Ethernet Jon> devices to be generally good. Thanks for the feedback! You missed a fun meeting last night. Jon> md Jon> On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG <wlug(a)lists.wlug.org> wrote: Jon> Guys, Jon> I'm looking into Zeek and unfortunately I don't have a second ethernet Jon> port on my main system, so it's not clear how I'd run a span port off Jon> my main switch to grab traffic. Jon> What hardware do people recommend for a zeek data collection node? I Jon> guess I could spin up my old WRAP board (http://www.pcengines.ch) Jon> which I used as my main router for years before I replaced it Jon> recently. But it's not super fast. It's got three 1gb ports, and 4gb Jon> of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp Jon> since I can install Debian Buster on there without too much trouble. Jon> Sweet! Jon> John Jon> _______________________________________________ Jon> WLUG mailing list -- wlug(a)lists.wlug.org Jon> To unsubscribe send an email to wlug-leave(a)lists.wlug.org Jon> Create Account: https://wlug.mailman3.com/accounts/signup/ Jon> Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ Jon> Web Forum/Archive: Jon> https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L…

April 9, 2021

Re: Zeek - from yesterday's meeting

by Jon "maddog" Hall

From time to time I used a USB Ethernet port: https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter Generally they are about 25 USD. You might be able to find them on Ebay or other places for less than that. You might as well get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0 will not support 1 Gbit/second, whereas USB 3.0 will. On the other hand if the networking flow is not 1 Gbit/second then USB 2.0 might work fine. I have found the Linux support for these generic USB Ethernet devices to be generally good. md On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG <wlug(a)lists.wlug.org> wrote: > > Guys, > I'm looking into Zeek and unfortunately I don't have a second ethernet > port on my main system, so it's not clear how I'd run a span port off > my main switch to grab traffic. > > What hardware do people recommend for a zeek data collection node? I > guess I could spin up my old WRAP board (http://www.pcengines.ch) > which I used as my main router for years before I replaced it > recently. But it's not super fast. It's got three 1gb ports, and 4gb > of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp > since I can install Debian Buster on there without too much trouble. > Sweet! > > John > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L… >

April 9, 2021

Zeek - from yesterday's meeting

by John Stoffel

Guys, I'm looking into Zeek and unfortunately I don't have a second ethernet port on my main system, so it's not clear how I'd run a span port off my main switch to grab traffic. What hardware do people recommend for a zeek data collection node? I guess I could spin up my old WRAP board (http://www.pcengines.ch) which I used as my main router for years before I replaced it recently. But it's not super fast. It's got three 1gb ports, and 4gb of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp since I can install Debian Buster on there without too much trouble. Sweet! John

April 9, 2021

Reminder! We've got a meeting this Thursday (April 8th, 2021!)

by Tim Keller

Hey Everybody, This is a reminder that we have a meeting on April 8th, 2021. Same bat time, same bat channel Date: April 8th, 2021 7pm: Jitsi @ https://meet.jit.si/WlugMA Topic: As of yet, there's no topic for the meeting, however, there's a ton to talk about none the less! The PHP git server hack, the OpenSSL vulnerabilities, turns out the spectre mitigations can be mitigated? I'm sure more stuff will come up as well.. As usual drinks and refreshments aren't being provided as this is a virtual meeting.. But soon.. so soon I hope we'll all be able to get together safely. Thanks for being patient and coming to the meetings, I appreciate it. Tim.

April 5, 2021

Re: WLUG history - Doug Waud's Home Networking slide deck found!

by Doug Mildram

I read the first dozen+ slides ( real good wording/intro I'd say!) ..then ADD-like, surfed later slides and found a minor gem in slide30 so I'll type it back here if I may, just for fun : (Networking) Addressing and Networks (review exam :) What address/addresses represent a network and which a host (assume a netmask of 255.255.255.0) a) 192.168.1.35 b) 192.168.7.12 c) 192.168.3.0 d) 192.168.0.255 e) 192.168.0.0 ANSWER: ( network: c,e ) ( host: a,b ) d) is neither, it is the broadcast address for network e Notice how it is natural to refer to that network by its addr 192.168.0.0 Incidentally, that term "host". It simply means computer. You run into it alot when you are setting up ip addresses. (end of slide 30). ============== dmildram,static> those were the days. Mask? What Mask? I'm gonna need one, once networked? -Host On Sat, Mar 13, 2021 at 12:16 PM Chuck Anderson via WLUG < wlug(a)lists.wlug.org> wrote: > On Fri, Jan 24, 2020 at 08:11:20AM -0500, Andy Stewart wrote: > > I remember a talk that Doug Waud gave about computer networking. His > first > > example of a network was a string with a cup at either end. > > Over a year ago when this discussion started, I saw Andy's comment > above about Doug Waud's home networking talk. I remember the talk > fondly, with the slides containing many humorous pictures of tin cans > and string. The WLUG website had a link to Doug's slide deck, but it > was a broken link to http://www.townisp.com/~dougwaud/homenet.htm. I > spent hours looking for a backup of the slides on my systems and on > the Wayback Machine (archive.org) I even contacted TownISP's support > to see if they had a backup of users' old websites, to no avail. So I > gave up and never mentioned it at the time. > > Well guess what...fast forward to today...I was looking for something > unrelated and stumbled upon a backup of my long gone Sun Ultra 10 > system that ran Aurora Linux (a rebuild of Red Hat/Fedora), and in > there I found a copy of the slide deck! > > So I updated the WLUG website's Archive section [1] with the slides: > > Home Networking (March 2001) > > Presented by Doug Waud. Written by Doug Waud, Chuck Anderson, and Stephen > Daukas. > > You may view the online presentation [2] at your leisure, or you may > download the HTML [3] or the download the original StarOffice slide deck > [4]. > > [1] http://www.wlug.org/archives.html > [2] http://www.wlug.org/files/homenet/html/networking.html > [3] http://www.wlug.org/files/homenet/homenet.tgz > [4] http://www.wlug.org/files/homenet/networking.sdd > > Enjoy! > _______________________________________________ > WLUG mailing list -- wlug(a)lists.wlug.org > To unsubscribe send an email to wlug-leave(a)lists.wlug.org > Create Account: https://wlug.mailman3.com/accounts/signup/ > Change Settings: > https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/ > Web Forum/Archive: > https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/EJJT5… >

March 13, 2021

Re: WLUG history - Doug Waud's Home Networking slide deck found!

by Keith Wright

Chuck Anderson via WLUG <wlug(a)lists.wlug.org> writes: > On Fri, Jan 24, 2020 at 08:11:20AM -0500, Andy Stewart wrote: >> I remember a talk that Doug Waud gave about computer networking. >> His first example of a network was a string with a cup at either end. > > Over a year ago when this discussion started, I saw Andy's comment > above about Doug Waud's home networking talk. I remember the talk > fondly, with the slides containing many humorous pictures of tin cans > and string. I was surprised that I did not remember this talk. I thought I had been to every WLUG meeting back then. Memories fade. I am trying to remember when I went to Mexico...I am pretty sure I was there several times. At the time I was sure I would remember every detail forever, but now I can't recall what year it was. It might have been 2001. > So I updated the WLUG website's Archive section [1] with the slides: > Home Networking (March 2001) Great job of cyber-archeology! I checked it out. It's 80 slides!! That's not a talk; It's at least four talks. I could not have forgotten all that---must not have been there. It's already proven useful in a way redeems WLUG. After moving ethernet cables around to do jit.sw/WlugMA last Thursday, I discovered I had broken another one of those stupid little plastic latch pins on the end plug. I bought a bag of a dozen at Stark electronics about the time of Doug's talk two decades ago. I am down to just three of them. Stark is long gone; where can I get more? I thought of Google, but I could not remember what the plugs were called. After paging quickly through a few slides, there was the answer! They are called RJ-45 plugs and you can buy them through Amazon. They come in bags of 100, which is excessive, but not too expensive; ($10-15). I suppose I will get a bag. That's more than a liftime supply. In a couple more decades you will be able to pick up about 90 of them _real_ cheap at the estate sale, or free from the dumpster. -- Keith

March 13, 2021