nickwallen commented on issue #21: METRON-1911 Docker setup for testing bro plugin URL: https://github.com/apache/metron-bro-plugin-kafka/pull/21#issuecomment-449765329 I was able to run this successfully. Yay! ``` $ cd docker $ /run_end_to_end.sh ... {"notice": {"ts":1320435875.879278,"note":"SSH::Password_Guessing","msg":"172.16.238.1 appears to be guessing SSH passwords (seen in 30 connections).","sub":"Sampled servers: 172.16.238.136, 172.16.238.136, 172.16.238.136, 172.16.238.136, 172.16.238.136","src":"172.16.238.1","peer_descr":"bro","actions":["Notice::ACTION_LOG"],"suppress_for":3600.0,"dropped":false}} {"capture_loss": {"ts":1320435958.419451,"ts_delta":493.659207,"peer":"bro","gaps":2,"acks":4854,"percent_lost":0.041203}} Run complete The kafka output can be found at /Users/nallen/tmp/metron-bro-plugin-kafka-pr21/docker/kafka_output/kafka-output-Mon_Dec_24_12:24:43_EST_2018.log You may now work with the containers if you will. You need to call finish_end_to_end.sh when you are done ``` Q1. Confirm my understanding. It input the raw pcap to Bro and then pulled out the telemetry produced by the plugin from Kafka, right? That raw telemetry pulled from Kafka is what I see at `docker/kafka_output/kafka-output-Mon_Dec_24_12:24:43_EST_2018.log`? Q2. As we know, the plugin has a bug. With this setup, how do I 'witness' that failure? How do I know that it is failing? Q3. There is nothing right now that is actually validating the output in Kafka, right? For example, I put in TEST1.pcap and I expect the Kafka output to have 31 records that looks like X, Y, and Z. It just grabs whatever is in the topic and adds it to the log and it is up to the user to validate correctness. I think this is a great start.
---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services
