threathunterx / sniffer Goto Github PK

git clone --recursive https://github.com/threathunterX/sniffer.git

The authenticity of host 'lab.threathunter.cn (120.78.11.118)' can't be established.
ECDSA key fingerprint is SHA256:YRHNH4AkHksz/ZgOlQyXa9tJRCIrdF+Mn3KAGvBP6m4.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'lab.threathunter.cn,120.78.11.118' (ECDSA) to the list of known hosts.
[email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
fatal: clone of '[email protected]:open_nebula/python_lib.git' into submodule path

另外根据文档，启动nebula，修改sniffer配置为

• SOURCES=default
  #default driver
  • DRIVER_INTERFACE=eth0
  • DRIVER_PORT=80,8080
  • BRO_PORT=47000
    并增加撞库IP策略,
    ./ctrl.sh start
    ./docker-compose up -d
    捕捉不了流量

数据抓取一段时间后，不显示数据了。重启后又显示一段时间。好像跟数据量也有关系。这里我部署了两套，看起来是数据量到一定程度就不显示数据了
main.client-com6-1.log 如下

2019-11-25 15:35:06,182 - DEBUG - main.py:163 - msg has passed the filter
2019-11-25 15:35:06,183 - DEBUG - main.py:231 - get id for this batch of events {'did': '', 'uid': '', 'sid': ''}

这个数据量大，大概6小时后，就没数据了

这个shujuliang数据量小，持续一周，会没数据