offline:wrccdc_pcaps_trisulnsm
Differences
This shows you the differences between two versions of the page.
Next revision | Previous revision | ||
offline:wrccdc_pcaps_trisulnsm [2018/05/12 16:26] – created veera | offline:wrccdc_pcaps_trisulnsm [2018/05/13 00:12] (current) – [Download the PCAPs] veera | ||
---|---|---|---|
Line 9: | Line 9: | ||
* [[offline: | * [[offline: | ||
* Part 2: How to use the free TrisulNSM Docker Image to analyze the PCAP dump | * Part 2: How to use the free TrisulNSM Docker Image to analyze the PCAP dump | ||
- | * Part 3: Screenshots & video of possible analysis paths (using TrisulNSM) | + | * [[offline: |
+ | |||
+ | |||
+ | ===== Instructions to run TrisulNSM over the PCAPs ===== | ||
+ | |||
+ | |||
+ | ==== Install Docker ==== | ||
+ | |||
+ | |||
+ | First install Docker on your host platform. We recommend Ubuntu 16.04 of CentOS 7.4. We have instructions on the [[https:// | ||
+ | |||
+ | |||
+ | ==== Download the PCAPs ==== | ||
+ | |||
+ | |||
+ | First choose a root directory to be used as the shared Docker " | ||
+ | |||
+ | |||
+ | Here have downloaded the first 8 files into the directory | ||
+ | |||
+ | |||
+ | < | ||
+ | root@unpl: | ||
+ | total 3.8G | ||
+ | -rw-r--r-- 1 root root 477M May 10 12:28 wrccdc.2018-03-23.010014000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M May 10 12:28 wrccdc.2018-03-23.010103000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M May 10 12:28 wrccdc.2018-03-23.010232000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M May 10 12:28 wrccdc.2018-03-23.010356000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M May 10 12:29 wrccdc.2018-03-23.010717000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M May 10 12:29 wrccdc.2018-03-23.010904000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M Mar 23 20:13 wrccdc.2018-03-23.011313000000000.pcap | ||
+ | -rw-r--r-- 1 root root 477M Mar 23 20:13 wrccdc.2018-03-23.011338000000000.pcap | ||
+ | root@unpl: | ||
+ | </ | ||
+ | |||
+ | |||
+ | |||
+ | ==== Run the Docker image over the pcaps ==== | ||
+ | |||
+ | Next step is to run the '' | ||
+ | |||
+ | |||
+ | < | ||
+ | |||
+ | sudo docker run --name=trisul1n \ | ||
+ | --privileged=true --net=host -v / | ||
+ | -d trisulnsm/ | ||
+ | --webserver-port 4000 --websockets-port 4003 \ | ||
+ | --fine-resolution | ||
+ | --pcap | ||
+ | </ | ||
+ | |||
+ | |||
+ | A quick note on the command line options we're using. For a complete list of options see [[https:// | ||
+ | |||
+ | |'' | ||
+ | |'' | ||
+ | |'' | ||
+ | |'' | ||
+ | |'' | ||
+ | |||
+ | |||
+ | === Wait for completion === | ||
+ | |||
+ | Now TrisulNSM is crunching the PCAPs. You can monitor the progress by running the following command. | ||
+ | |||
+ | |||
+ | < | ||
+ | docker logs -f trisul1n | ||
+ | </ | ||
+ | |||
+ | The rough time taken in our very modest system was around 40 seconds per file. When the processing finishes you will see something like this. | ||
+ | |||
+ | < | ||
+ | |||
+ | Finished elapsed : 328 seconds | ||
+ | |||
+ | |||
+ | ==== SUCCESSFULLY IMPORTED FROM PCAP REPO / | ||
+ | ==== TO VIEW DASHBOARDS ===== | ||
+ | ==== 1. login to the Web Trisul interface ===== | ||
+ | ==== 2. select wrccdc1 on the Login Screen ===== | ||
+ | |||
+ | Started TrisulNSM docker image. Sleeping. | ||
+ | |||
+ | </ | ||
+ | |||
+ | |||
+ | ==== Next ==== | ||
+ | |||
+ | |||
+ | Thats it ! Now you are ready to analyze the network data using Trisul. That is [[offline: | ||
offline/wrccdc_pcaps_trisulnsm.1526122589.txt.gz · Last modified: 2018/05/12 16:26 by veera