You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@metron.apache.org by nickwallen <gi...@git.apache.org> on 2016/06/21 21:43:28 UTC
[GitHub] incubator-metron pull request #166: METRON-247 Using IP of the sniff interfa...
GitHub user nickwallen opened a pull request:
https://github.com/apache/incubator-metron/pull/166
METRON-247 Using IP of the sniff interface as Snort's home network
Snort was previously using the IPv4 address of the `eth0` network interface as its HOME_NET. This is a problem, of course, if there is no such interface. The deployment was failing when run on hosts that do not have an `eth0` network interface.
This fix uses the IPv4 address of the `sniff_interface` as a sensible default. This works fine for most development or demo builds of Metron. For other deployments, the user can override `snort_home_net` to define this value appropriately for their environment.
In the case of using canned or replayed pcap data for testing, this value also needs to be adjusted based on the pcap data. For this scenario, I altered 'sensor-test-mode' to use a `HOME_NET` of `any` so that it correctly alerts on every packet seen.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/nickwallen/incubator-metron METRON-247
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/incubator-metron/pull/166.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #166
----
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #166: METRON-247 Deployment fails on hosts with no 'e...
Posted by james-sirota <gi...@git.apache.org>.
Github user james-sirota commented on the issue:
https://github.com/apache/incubator-metron/pull/166
+1 Ran it up on AWS
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
Re: [GitHub] incubator-metron pull request #166: METRON-247
Deployment fails on hosts wit...
Posted by Nick Allen <ni...@nickallen.org>.
I often skip the wait also, but the mount checks are very time consuming
too. This change helped me test the PR faster. I'd prefer for it to just
go together.
On Wed, Jun 22, 2016 at 8:16 AM, dlyle65535 <gi...@git.apache.org> wrote:
> Github user dlyle65535 commented on a diff in the pull request:
>
>
> https://github.com/apache/incubator-metron/pull/166#discussion_r68042048
>
> --- Diff: metron-deployment/amazon-ec2/playbook.yml ---
> @@ -62,6 +62,7 @@
> - include: tasks/check-volume.yml vol_name=xvda vol_src=/dev/xvda
> vol_size={{ xvda_vol_size }}
> tags:
> - ec2
> + - ec2-mount
>
> --- End diff --
>
> I think the timely part is the wait, so --skip-tags="wait" usually
> works for me, but if you really want this, couldn't it be part of a JIRA
> that addresses performance rather than the snort deploy bug?
>
>
> ---
> If your project is set up for it, you can reply to this email and have your
> reply appear on GitHub as well. If your project does not have this feature
> enabled and wishes so, or if the feature is enabled but not working, please
> contact infrastructure at infrastructure@apache.org or file a JIRA ticket
> with INFRA.
> ---
>
--
Nick Allen <ni...@nickallen.org>
[GitHub] incubator-metron pull request #166: METRON-247 Deployment fails on hosts wit...
Posted by dlyle65535 <gi...@git.apache.org>.
Github user dlyle65535 commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/166#discussion_r68042048
--- Diff: metron-deployment/amazon-ec2/playbook.yml ---
@@ -62,6 +62,7 @@
- include: tasks/check-volume.yml vol_name=xvda vol_src=/dev/xvda vol_size={{ xvda_vol_size }}
tags:
- ec2
+ - ec2-mount
--- End diff --
I think the timely part is the wait, so --skip-tags="wait" usually works for me, but if you really want this, couldn't it be part of a JIRA that addresses performance rather than the snort deploy bug?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #166: METRON-247 Deployment fails on hosts wit...
Posted by nickwallen <gi...@git.apache.org>.
Github user nickwallen commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/166#discussion_r68041772
--- Diff: metron-deployment/amazon-ec2/playbook.yml ---
@@ -62,6 +62,7 @@
- include: tasks/check-volume.yml vol_name=xvda vol_src=/dev/xvda vol_size={{ xvda_vol_size }}
tags:
- ec2
+ - ec2-mount
--- End diff --
No. This allows us to skip the timely disk mount step.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #166: METRON-247 Deployment fails on hosts with no 'e...
Posted by dlyle65535 <gi...@git.apache.org>.
Github user dlyle65535 commented on the issue:
https://github.com/apache/incubator-metron/pull/166
Thanks for taking this on. I assume this was Vagranted, did you do any other testing?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #166: METRON-247 Deployment fails on hosts wit...
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/incubator-metron/pull/166
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron pull request #166: METRON-247 Deployment fails on hosts wit...
Posted by dlyle65535 <gi...@git.apache.org>.
Github user dlyle65535 commented on a diff in the pull request:
https://github.com/apache/incubator-metron/pull/166#discussion_r67962178
--- Diff: metron-deployment/amazon-ec2/playbook.yml ---
@@ -62,6 +62,7 @@
- include: tasks/check-volume.yml vol_name=xvda vol_src=/dev/xvda vol_size={{ xvda_vol_size }}
tags:
- ec2
+ - ec2-mount
--- End diff --
Did this come in by mistake?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #166: METRON-247 Deployment fails on hosts with no 'e...
Posted by cestella <gi...@git.apache.org>.
Github user cestella commented on the issue:
https://github.com/apache/incubator-metron/pull/166
+1
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] incubator-metron issue #166: METRON-247 Deployment fails on hosts with no 'e...
Posted by nickwallen <gi...@git.apache.org>.
Github user nickwallen commented on the issue:
https://github.com/apache/incubator-metron/pull/166
Tested on Vagrant and AWS
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---