Hi All,
I also get my second shot Tuesday. Go team Phyz!
I can do remote meeting this week.
Can do either Jitsi or in person in June and beyond.
Joel
On May 7, 2021 10:36:10 AM John Stoffel via WLUG <wlug(a)lists.wlug.org> wrote:
> Tim> We've got a meeting on May 13th!
>
> Dang, won't make it because I'm travelling for work. Half vaccinated
> too. I get the second after I get back, yay!
>
> Tim> For topics, there's a whole lot to talk about! Obviously the UMN
> Tim> stuff, as well as the x86 decoder fun.
>
> And I wish I had more to talk about zeek too. It was interesting
> getting it installed, but I recently rebuilt that box to run the
> TP-Link Omada software on a dedicated box. I'm annoyed that they're
> Java web app is so damn far behind in terms of OS support.
>
> But having a tool to summarize zeek stuff better would be nice. The
> daily report was interesting, but not really what I wanted, but I'm
> not sure what I want. Something simple and ASCII, but focused. Lots
> to talk about there, but maybe leave that to another meeting.
>
>
> Tim> I think it's worth revisiting having in person meetings.. At some
> Tim> point here in the near future a majority of us are going to be
> Tim> vaccinated. I'll reach out to Kevin (if he's not already reading
> Tim> this!) and see what Technopia's policies are going to
> Tim> be. Whatever we do, I think we've all agreed it makes sense to
> Tim> keep the virtual component going as well. To that point, I'll be
> Tim> getting my second shot on Tuesday so I might be not feeling
> Tim> great, we'll see.
>
> I've been meaning/wanting to visit Technopia and to even join so as to
> have a place to go where I can be around other motivated people and
> work on my Phd (Projects Half Done) stuff. Plus there's good places
> around there for food afterwards.
>
> Heck, in another year or so it might be fun to do a wlug woo-sox game
> meeting.
>
>
> _______________________________________________
> WLUG mailing list -- wlug(a)lists.wlug.org
> To unsubscribe send an email to wlug-leave(a)lists.wlug.org
> Create Account: https://wlug.mailman3.com/accounts/signup/
> Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/
> Web Forum/Archive: https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/3OFZM…
Tim> We've got a meeting on May 13th!
Dang, won't make it because I'm travelling for work. Half vaccinated
too. I get the second after I get back, yay!
Tim> For topics, there's a whole lot to talk about! Obviously the UMN
Tim> stuff, as well as the x86 decoder fun.
And I wish I had more to talk about zeek too. It was interesting
getting it installed, but I recently rebuilt that box to run the
TP-Link Omada software on a dedicated box. I'm annoyed that they're
Java web app is so damn far behind in terms of OS support.
But having a tool to summarize zeek stuff better would be nice. The
daily report was interesting, but not really what I wanted, but I'm
not sure what I want. Something simple and ASCII, but focused. Lots
to talk about there, but maybe leave that to another meeting.
Tim> I think it's worth revisiting having in person meetings.. At some
Tim> point here in the near future a majority of us are going to be
Tim> vaccinated. I'll reach out to Kevin (if he's not already reading
Tim> this!) and see what Technopia's policies are going to
Tim> be. Whatever we do, I think we've all agreed it makes sense to
Tim> keep the virtual component going as well. To that point, I'll be
Tim> getting my second shot on Tuesday so I might be not feeling
Tim> great, we'll see.
I've been meaning/wanting to visit Technopia and to even join so as to
have a place to go where I can be around other motivated people and
work on my Phd (Projects Half Done) stuff. Plus there's good places
around there for food afterwards.
Heck, in another year or so it might be fun to do a wlug woo-sox game
meeting.
Tim,
For what it is worth I got my second Pfizer shot February 27th. On March
11th I flew to Miami, Florida for an IPO of Digital Ocean (a friend of mine
is a founder), directly into the middle of maskless College idiots doing
spring break (I wore a mask and practiced social distancing as well as
getting my first two tests for COVID). Two weeks later I flew to Rio de
Janeiro for a month (business meetings and to see my husband for the first
time in a year). I feel safe in going to indoor restaurants (I still wear
my mask when not actively eating and drinking.
I trust in medicine, science and statistics, and I feel like Superman.
So I would support in-person meetings for vaccinated people, particularly
if masks are used.
md
On Thu, May 6, 2021 at 10:04 AM Tim Keller via WLUG <wlug(a)lists.wlug.org>
wrote:
> Hey Gang!
>
> We've got a meeting on May 13th!
>
> For topics, there's a whole lot to talk about! Obviously the UMN stuff, as
> well as the x86 decoder fun.
>
> I think it's worth revisiting having in person meetings.. At some point
> here in the near future a majority of us are going to be vaccinated. I'll
> reach out to Kevin (if he's not already reading this!) and see what
> Technopia's policies are going to be. Whatever we do, I think we've all
> agreed it makes sense to keep the virtual component going as well. To that
> point, I'll be getting my second shot on Tuesday so I might be not feeling
> great, we'll see.
>
> What do people think?
>
> Later,
> Tim.
>
> --
> I am leery of the allegiances of any politician who refers to their
> constituents as "consumers".
> _______________________________________________
> WLUG mailing list -- wlug(a)lists.wlug.org
> To unsubscribe send an email to wlug-leave(a)lists.wlug.org
> Create Account: https://wlug.mailman3.com/accounts/signup/
> Change Settings:
> https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/
> Web Forum/Archive:
> https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/DWVD6…
>
Hey Gang!
We've got a meeting on May 13th!
For topics, there's a whole lot to talk about! Obviously the UMN stuff, as
well as the x86 decoder fun.
I think it's worth revisiting having in person meetings.. At some point
here in the near future a majority of us are going to be vaccinated. I'll
reach out to Kevin (if he's not already reading this!) and see what
Technopia's policies are going to be. Whatever we do, I think we've all
agreed it makes sense to keep the virtual component going as well. To that
point, I'll be getting my second shot on Tuesday so I might be not feeling
great, we'll see.
What do people think?
Later,
Tim.
--
I am leery of the allegiances of any politician who refers to their
constituents as "consumers".
> On Apr 13, 2021, at 4:26 PM, Chuck Anderson via WLUG <wlug(a)lists.wlug.org> wrote:
>
> On Tue, Apr 13, 2021 at 09:16:10AM -0400, John Stoffel via WLUG wrote:
>> Now that I have zeek up and running... what's the best tool/process
>> for viewing the data? Looking at the hourly emailed logs is sorta
>> interesting, but honestly not a great way to see trends over time.
>
> I know people use $$$$$plunk (Splunk) for that sort of thing. Perhaps
> ELK (Elasticsearch, Logstash, and Kibana) would work. Oh look,
> someone has a recipe for how to do that:
>
> https://logz.io/blog/bro-elk-part-1/
I am one of the $plunk users. Their free tier is fine, though it has less features (authentication being one of them) so I’d put something in front of it. The Splunk Zeek app is really good; if you go the Splunk route let me know.
> _______________________________________________
> WLUG mailing list -- wlug(a)lists.wlug.org
> To unsubscribe send an email to wlug-leave(a)lists.wlug.org
> Create Account: https://wlug.mailman3.com/accounts/signup/
> Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/
> Web Forum/Archive: https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/SXYJZ…
On Tue, Apr 13, 2021 at 09:16:10AM -0400, John Stoffel via WLUG wrote:
> Now that I have zeek up and running... what's the best tool/process
> for viewing the data? Looking at the hourly emailed logs is sorta
> interesting, but honestly not a great way to see trends over time.
I know people use $$$$$plunk (Splunk) for that sort of thing. Perhaps
ELK (Elasticsearch, Logstash, and Kibana) would work. Oh look,
someone has a recipe for how to do that:
https://logz.io/blog/bro-elk-part-1/
Guys,
Now that I have zeek up and running... what's the best tool/process
for viewing the data? Looking at the hourly emailed logs is sorta
interesting, but honestly not a great way to see trends over time.
I've looked over the zeek.org website, and there's no real discussion
there on how to summarize and get a good high level view of what's
going on. Even just a daily report would be better, I think.
So what I'm doing is setting up my core switch to mirror all the
traffic between the switch and the router, while I also have the zeek
box on another port on the switch for management. This seems to be
working well so far, it's seeing all my traffic to/from the internet
and the various devices connected.
Cheers,
John
>>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes:
>> You missed a fun meeting last night.
Jon> I am sure I did. Unfortunately I am in Rio de Janeiro and was
Jon> tied up with another meeting.
Have a great time down there. Brazil is definitely on my list of
places to visit some day. Along with Argentina, Chile, Peru.... lots
of places in the world to see still.
>You missed a fun meeting last night.
I am sure I did. Unfortunately I am in Rio de Janeiro and was tied up with
another meeting.
Warmest regards,
maddog
On Fri, Apr 9, 2021 at 7:21 PM John Stoffel <john(a)stoffel.org> wrote:
> >>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes:
>
> Jon> From time to time I used a USB Ethernet port:
> Jon> https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter
>
> I used to have one of those kicking around, but for now I'm going to
> go with the APU2 dedicated hardware box, it should have enough oomph
> once I get Debian Buster (10.10) installed on it.
>
> Jon> Generally they are about 25 USD. You might be able to find them
> Jon> on Ebay or other places for less than that. You might as well
> Jon> get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0
> Jon> will not support 1 Gbit/second, whereas USB 3.0 will. On the
> Jon> other hand if the networking flow is not 1 Gbit/second then USB
> Jon> 2.0 might work fine.
>
> Jon> I have found the Linux support for these generic USB Ethernet
> Jon> devices to be generally good.
>
> Thanks for the feedback! You missed a fun meeting last night.
>
> Jon> md
>
> Jon> On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG <
> wlug(a)lists.wlug.org> wrote:
>
> Jon> Guys,
> Jon> I'm looking into Zeek and unfortunately I don't have a second
> ethernet
> Jon> port on my main system, so it's not clear how I'd run a span port
> off
> Jon> my main switch to grab traffic.
>
> Jon> What hardware do people recommend for a zeek data collection
> node? I
> Jon> guess I could spin up my old WRAP board (http://www.pcengines.ch)
> Jon> which I used as my main router for years before I replaced it
> Jon> recently. But it's not super fast. It's got three 1gb ports, and
> 4gb
> Jon> of RAM with a 1Ghz single core AMD CPU. So it might do the job,
> esp
> Jon> since I can install Debian Buster on there without too much
> trouble.
> Jon> Sweet!
>
> Jon> John
> Jon> _______________________________________________
> Jon> WLUG mailing list -- wlug(a)lists.wlug.org
> Jon> To unsubscribe send an email to wlug-leave(a)lists.wlug.org
> Jon> Create Account: https://wlug.mailman3.com/accounts/signup/
> Jon> Change Settings:
> https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/
> Jon> Web Forum/Archive:
> Jon>
> https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L…
>
>
>>>>> "Jon" == Jon \"maddog\" Hall <jon.maddog.hall(a)gmail.com> writes:
Jon> From time to time I used a USB Ethernet port:
Jon> https://www.bestbuy.com/site/shop/usb-to-ethernet-adapter
I used to have one of those kicking around, but for now I'm going to
go with the APU2 dedicated hardware box, it should have enough oomph
once I get Debian Buster (10.10) installed on it.
Jon> Generally they are about 25 USD. You might be able to find them
Jon> on Ebay or other places for less than that. You might as well
Jon> get a USB 3.0, since it will work with USB 2.0 ports, but USB 2.0
Jon> will not support 1 Gbit/second, whereas USB 3.0 will. On the
Jon> other hand if the networking flow is not 1 Gbit/second then USB
Jon> 2.0 might work fine.
Jon> I have found the Linux support for these generic USB Ethernet
Jon> devices to be generally good.
Thanks for the feedback! You missed a fun meeting last night.
Jon> md
Jon> On Fri, Apr 9, 2021 at 5:09 PM John Stoffel via WLUG <wlug(a)lists.wlug.org> wrote:
Jon> Guys,
Jon> I'm looking into Zeek and unfortunately I don't have a second ethernet
Jon> port on my main system, so it's not clear how I'd run a span port off
Jon> my main switch to grab traffic.
Jon> What hardware do people recommend for a zeek data collection node? I
Jon> guess I could spin up my old WRAP board (http://www.pcengines.ch)
Jon> which I used as my main router for years before I replaced it
Jon> recently. But it's not super fast. It's got three 1gb ports, and 4gb
Jon> of RAM with a 1Ghz single core AMD CPU. So it might do the job, esp
Jon> since I can install Debian Buster on there without too much trouble.
Jon> Sweet!
Jon> John
Jon> _______________________________________________
Jon> WLUG mailing list -- wlug(a)lists.wlug.org
Jon> To unsubscribe send an email to wlug-leave(a)lists.wlug.org
Jon> Create Account: https://wlug.mailman3.com/accounts/signup/
Jon> Change Settings: https://wlug.mailman3.com/postorius/lists/wlug.lists.wlug.org/
Jon> Web Forum/Archive:
Jon> https://wlug.mailman3.com/hyperkitty/list/wlug@lists.wlug.org/message/HCS2L…
