PCAP Capture and Storage

Packet capture (PCAP), also known as network packet capture, is the process of intercepting and logging traffic that passes through a computer network. When packets (data units) are transmitted over a network, they contain information such as the source and destination addresses, the type of protocol used, and the content of the packet.

A packet capture tool (such as Moloch or Arkime) captures these packets as they are transmitted through a network interface and saves them in a file for later analysis. Packet capture is a commonly used technique for network troubleshooting, performance monitoring, and security analysis. It allows network administrators to identify and diagnose issues such as network congestion, application errors, and security threats by inspecting real-time network traffic content or after an occurrence.

Feature Value

The ability to store incident PCAPs in the LogRhythm NDR database provides significant value to customers by enabling them to monitor and investigate network traffic to identify security threats and other issues. Storing the PCAPs allows customers to have a detailed record of all the network traffic that can be used for forensic analysis, troubleshooting, and compliance purposes.

By providing a configuration option to delete PCAP files from the database, customers can effectively manage the storage of these files, reducing the risk of data overload and ensuring that the database remains optimized for performance. This functionality enables customers to maintain the security and stability of their system, which is a critical aspect of any network monitoring solution.

The ability to store and manage PCAPs in the LogRhythm NDR database provides customers with enhanced visibility into their network traffic, which is crucial for identifying and mitigating security threats and other network issues.

Getting Started

For each case/incident, the LogRhythm NDR makes a REST API call to retrieve the relevant packet capture (PCAP) file. The API is called with specific parameter values, including the event UUID, entry source, and filename, to ensure that the correct file is retrieved.

Once the API call is made with the appropriate parameter values, the API returns the PCAP file associated with the specific event UUID, entry source, and filename. This functionality allows network administrators and security analysts to review specific network events captured by LogRhythm NDR for forensic analysis or troubleshooting purposes.

By providing this REST API functionality to its customers, LogRhythm NDR enables efficient and effective analysis of network traffic, enhancing the ability to detect and respond to security threats and other network issues.

REST API to get PCAP details

The URL endpoint provides the path to retrieve a specific PCAP file from Moloch, a network traffic analysis tool.

GET /getmolochpcap/{event_uuid}/{entry_source}/{filename}

The URL includes three main parameters, as follows:

Installation and Management

Installing Moloch version 2.4.2

1. To download the moloch_2.4.2-1_amd64.deb file from the specified URL in Ubuntu 20.04 using wget, enter the below command:

   CODE

   wget "https://s3.amazonaws.com/files.molo.ch/builds/ubuntu-20.04/moloch_2.4.2-1_amd64.deb"

2. Once the package is downloaded, install the downloaded package moloch_2.4.2-1_amd64.deb in Ubuntu using the following command:
   

   CODE

   sudo apt install ./moloch_2.4.2-1_amd64.deb

   This command assumes that the moloch_2.4.2-1_amd64.deb file is present in the current directory. The sudo command is used to execute the installation command with administrative privileges, while apt install is the command to install the specified package using the Advanced Packaging Tool (APT) package manager.

3. To configure Moloch (with administrative privileges), use the following command:

   CODE

   sudo /data/moloch/bin/Configure

   The above command enables Moloch with interface monitoring, Elasticsearch settings, password encryption, and optional GEO file download.

4. Follow the prompts and refer /data/moloch/README.txt for further setup instructions.
   You will be prompted to specify the network interface.

5. Enter the network interface name and click Enter to continue.

6. Initialize the Elasticsearch Moloch configuration by using the following command:

   CODE

   /data/moloch/db/db.pl http://<ip>:9200 init

7. Change Elasticsearch to the tunnel IP address of that node in sudo nano /data/moloch/etc/config.ini.

8. Create an administrator user account for Moloch with the following command:
   

   CODE

   /data/moloch/bin/moloch_add_user.sh admin "Moloch SuperAdmin" <password> --admin

   The Moloch service must be started immediately.

9. To start the molochcapture service and enable them to start the system reboot, use the following command:
   

   CODE

   systemctl enable --now molochcapture

10. To check the capture log, run the following command:

    CODE

    sudo tail -f /data/moloch/logs/capture.log

11. To check the Moloch version, run the following command:

    CODE

    /opt/moloch/bin/moloch-capture --version

    For further details on how to install the packet capture tool, see https://www.howtoforge.com/how-to-install-arkime-full-packet-capture-tool-on-ubuntu-20-04/.

Moloch Dependency - Deprecation of Shared Library

Ubuntu 20.04 does not include libssl.so.1.0.0 by default, as it has been deprecated and replaced with newer versions of OpenSSL.

However, there are a few ways to install this library on Ubuntu 20.04. Two options are mentioned below:

Option 1: Install from a Package Repository

1. Add the Ubuntu 18.04 (Bionic) repository to your system by running the below command:

   CODE

   sudo add-apt-repository deb "http://security.ubuntu.com/ubuntu" bionic-security main

2. Update the package list with this command.
   

   CODE

   sudo apt-get update

3. Install the libssl1.0.0 package.
   

   CODE

   sudo apt-get install libssl1.0.0

Option 2: Download and Install Manually

1. Download the libssl1.0.0 package from the Ubuntu 18.04 repository.

   CODE

   wget "http://security.ubuntu.com/ubuntu"/pool/main/o/openssl1.0/libssl1.0.0_1.0.2n-1ubuntu5.6_amd64.deb

2. Install the package.
   

   CODE

   sudo dpkg -i libssl1.0.0_1.0.2n-1ubuntu5.6_amd64.deb

An older version of OpenSSL can pose security risks, as newer versions include bug fixes and security patches. A newer version of Moloch must be used that is compatible with the latest version of OpenSSL.

Enabling PCAP

To enable the PCAP feature in LogRhythm NDR, do the following:

1. Log in to LogRhythm NDR.
2. Click the Settings tab and then click Policy Management.
3. Select Feature Configuration.
4. Click the checkbox corresponding to the PCAP Enable option.
5. Click the Update button to enable the PCAP feature and update the change in the database.

Enabling the PCAP feature through the user interface provides customers with the ability to capture and store packet capture data in the LogRhythm NDR database. This empowers them to investigate network traffic, identify security threats, and address other network-related issues. By offering a simple and straightforward method to enable this feature, LogRhythm NDR enables its customers to maximize the effectiveness of their network monitoring solution.

Managing PCAP

The PCAP files are efficiently stored in the pcap_files PostgreSQL database. The pcap_files schema table has four columns, as follows:

The PCAP files are stored under a binary column named bin_data with the BYTEA data type. This storage method allows the efficient handling of huge files. The PCAP files are divided into smaller files and stored as binary data within the 'bin_data' column. This setup enables optimized storage and retrieval of PCAP files within PostgreSQL.

To ensure secure transmission and storage, a TLS (Transport Layer Security) encrypted connection can be established. In the configuration, the TLS encryption (ProbePGTLSEnabled) can be enabled or disabled by setting it to true or false, respectively.

• If the TLS encryption is disabled (false), authentication is established with a username and password.
• If the TLS encryption is enabled (true), authentication happens with the help of SSL certificates along with the username.

Frequently Asked Questions

Some of the most frequent questions are detailed in this section for better clarity.