В настоящее время моя сетевая структура выглядит так.
введите описание изображения здесь
br-f9073c9f24dd: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.18.0.1 netmask 255.255.0.0 broadcast 172.18.255.255
inet6 fe80::42:f6ff:fe96:f5e5 prefixlen 64 scopeid 0x20<link>
ether 02:42:f6:96:f5:e5 txqueuelen 0 (Ethernet)
RX packets 18534 bytes 1289526 (1.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 31451 bytes 60949693 (60.9 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
inet6 fe80::42:a7ff:fe0a:a84a prefixlen 64 scopeid 0x20<link>
ether 02:42:a7:0a:a8:4a txqueuelen 0 (Ethernet)
RX packets 74772 bytes 4175749 (4.1 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 127772 bytes 268246504 (268.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
enp4s0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
ether a8:5e:45:3d:2e:c9 txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xfa300000-fa37ffff
enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.127 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::793e:a6a:8448:7cd3 prefixlen 64 scopeid 0x20<link>
ether a8:5e:45:3d:2e:ca txqueuelen 1000 (Ethernet)
RX packets 1811702 bytes 2115220081 (2.1 GB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 768691 bytes 350190823 (350.1 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device memory 0xfa200000-fa27ffff
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 9410 bytes 864463 (864.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 9410 bytes 864463 (864.4 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth60bc38a: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::28c7:50ff:fe65:eed5 prefixlen 64 scopeid 0x20<link>
ether 2a:c7:50:65:ee:d5 txqueuelen 0 (Ethernet)
RX packets 17932 bytes 1482950 (1.4 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 30645 bytes 60680367 (60.6 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth8698a5e: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::a810:a7ff:fe97:c2d prefixlen 64 scopeid 0x20<link>
ether aa:10:a7:97:0c:2d txqueuelen 0 (Ethernet)
RX packets 135 bytes 14366 (14.3 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 370 bytes 55292 (55.2 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
Docker контейнеры имеют такую структуру.
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4b843af06c3e taeil777/taeil_mongo:v1 "docker-entrypoint.s…" 24 hours ago Up 24 hours 0.0.0.0:9000->22/tcp, 0.0.0.0:9017->27017/tcp server_taeil_mongo_1
fc8aec3b941f taeil777/taeil_influx:v1 "/entrypoint.sh infl…" 25 hours ago Up 25 hours 0.0.0.0:8086->8086/tcp, 0.0.0.0:9001->22/tcp server_taeil_influx_1
Я не знаю, как изменить /etc/suricata/suricata.yaml.
Как изменить файл suricata.yaml для управления трафиком c в контейнерах A и B?
Теперь он находится в suricata.yaml как HOME _NET: "[192.168.0.0/24]" и af-packet: interface: enp5s0.
Когда Suricata работает в этом состоянии, появляется следующий журнал:
6/8/2020 -- 15:57:29 - <Notice> - This is Suricata version 5.0.3 RELEASE running in SYSTEM mode
6/8/2020 -- 15:57:45 - <Notice> - all 16 packet processing threads, 4 management threads initialized, engine started.
6/8/2020 -- 15:57:29 - <Notice> - This is Suricata version 5.0.3 RELEASE running in SYSTEM mode
6/8/2020 -- 15:57:29 - <Info> - CPUs/cores online: 16
6/8/2020 -- 15:57:29 - <Info> - Found an MTU of 1500 for 'enp5s0'
6/8/2020 -- 15:57:29 - <Info> - Found an MTU of 1500 for 'enp5s0'
6/8/2020 -- 15:57:29 - <Info> - fast output device (regular) initialized: fast.log
6/8/2020 -- 15:57:29 - <Info> - eve-log output device (regular) initialized: eve.json
6/8/2020 -- 15:57:29 - <Info> - stats output device (regular) initialized: stats.log
6/8/2020 -- 15:57:29 - <Info> - Running in live mode, activating unix socket
6/8/2020 -- 15:57:34 - <Info> - 1 rule files processed. 20764 rules successfully loaded, 0 rules failed
6/8/2020 -- 15:57:34 - <Info> - Threshold config parsed: 0 rule(s) found
6/8/2020 -- 15:57:34 - <Info> - 20767 signatures processed. 1148 are IP-only rules, 3989 are inspecting packet payload, 15401 inspect application layer, 103 are decoder event only
6/8/2020 -- 15:57:45 - <Info> - Going to use 16 thread(s)
6/8/2020 -- 15:57:45 - <Info> - Running in live mode, activating unix socket
6/8/2020 -- 15:57:45 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
6/8/2020 -- 15:57:45 - <Notice> - all 16 packet processing threads, 4 management threads initialized, engine started.
6/8/2020 -- 15:57:46 - <Info> - All AFP capture threads are running.
Я не уверен, что все правильно или нет.
Что я могу сделать, чтобы отслеживать трафик c в контейнеры A и B?