Analyse son traffic avec Arkime

Wireshark mais en interface Web

Auteur : Vince NADUS
Date de publication : Dec. 10, 2021
réseaux reverse-proxy elasticsearch arkime sniff nginx

Toujours en partant d'une fresh install de Debian 11 64 Bits

Installation Arkime

apt-get install curl wget gnupg2
apt install ./arkime_3.2.0-1_amd64.deb

Installation Elasticsearch

wget -qO - | gpg --dearmor > /etc/apt/trusted.gpg.d/elastic.gpg
echo "deb stable main" > /etc/apt/sources.list.d/elastic-7.x.list
apt update
apt install elasticsearch -y

Démarrer le service Elasticsearch

systemctl enable --now elasticsearch

Test Elasticsearch

curl http://localhost:9200

Configuration Arkime


Selectionner l'interface à sniffer

Found interfaces: lo;enp0s3;enp0s8
Semicolon ';' seperated list of interfaces to monitor [eth1] enp0s8

Sélectionner l'instance Elasticsearch (ici nous serons sur le même serveur) et poursuivre la procédure de configuration

Install Elasticsearch server locally for demo, must have at least 3G of memory, NOT recommended for production use (yes or no) [no] no [or SIMPLY PRESS ENTER]
Elasticsearch server URL [http://localhost:9200] ENTER
Password to encrypt S2S and other things [no-default] votre_mdp
Moloch - Creating configuration files
Installing systemd start files, use systemctl
Moloch - Installing /etc/logrotate.d/moloch to rotate files after 7 days
Moloch - Installing /etc/security/limits.d/99-moloch.conf to make core and memlock unlimited
Download GEO files? (yes or no) [yes] yes
Moloch - Downloading GEO files
Arkime - Configured - Now continue with step 4 in /opt/arkime/README.txt

4) The Configure script can install elasticsearch for you or you can install yourself
systemctl start elasticsearch.service
5) Initialize/Upgrade Elasticsearch Arkime configuration
a) If this is the first install, or want to delete all data
/opt/arkime/db/ http://ESHOST:9200 init
b) If this is an update to a moloch/arkime package
/opt/arkime/db/ http://ESHOST:9200 upgrade
6) Add an admin user if a new install or after an init

Initialiser Elasticsearch pour les pré-requis Arkime

/opt/arkime/db/ http://ESHOST:9200 init

Créer l'utilisateur/administrateur Arkime/Moloch

/opt/arkime/bin/ admin "Arkime SuperAdmin" votre_mdp --admin

Démarrer les services Arkime/Moloch

Adapter les services Arkime/Moloch afin de démarrer une fois le service Elasticsearch disponible (Ex : Après un redémarrage de la machine)

sed -i 's/ elasticsearch.service/' /etc/systemd/system/arkimecapture.service /etc/systemd/system/arkimeviewer.service
sed -i '/After=/a elasticsearch.service' /etc/systemd/system/arkimecapture.service /etc/systemd/system/arkimeviewer.service
systemctl daemon-reload

Pour la capture réseau

systemctl enable --now arkimecapture
systemctl start arkimecapture

Pour l'interface Web

systemctl enable --now arkimeviewer
systemctl start arkimeviewer

Aller plus loin

Les fichiers de logs sont disponible ici


La configuration d'Arkime/Moloch est ici


Accès à l'interface


J'utilise pour ma part un Reverse proxy Nginx afin d'y acceder en https via un nom de domaine.

Configuration Reverse-Proxy Nginx

server {
if ($host = {
return 301 https://$host$request_uri;
listen 80;
listen [::]:80;
return 404;
server {
listen [::]:443 ssl;
listen 443 ssl;
access_log /var/log/nginx/;
error_log /var/log/nginx/;
location / {
proxy_pass http://X.X.X.X:8005;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
ssl_certificate /etc/letsencrypt/live/;
ssl_certificate_key /etc/letsencrypt/live/;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

Problème rencontré et correction

Sur la machine physique (Proxmox) et sur l'interface physique sur lequel nous envoyons le traffic.

apt-get install ethtool
ethtool -K INTERFACE tx off sg off gro off gso off lro off tso off


Effacer toutes les données

curl -X DELETE 'http://localhost:9200/_all'

Résoudre le problème de data exessives

curl -X PUT http://localhost:9200/_settings -H 'Content-Type: application/json' -d '{"index": {"blocks": {"read_only_allow_delete": "false"}}}'


Aller encore plus loin