Zeek::Testimony

This plugin provides native Testimony support for Zeek. Testimony is a single-machine, multi-process architecture for sharing AF_PACKET data across processes.
(https://github.com/google/testimony).

Installation

Package Manager ``````````` The plugin is available as package for the Zeek Package Manager <https://github.com/zeek/package-manager> and can be installed using the following command:

zkg install zeek-testimony-plugin

Manual Install `````````` The following will compile and install the AF_Packet plugin alongside Zeek, assuming it can find the kernel headers in a standard location:

# ./configure && make && make install

If everything built and installed correctly, you should see this:

# zeek -NN Zeek::Testimony
Zeek::Testimony - Packet acquisition from Google Testimony Unix socket (dynamic, no version information)
[Packet Source] TestimonyReader (interface prefix "testimony"; supports live input)

Usage

Once installed, you can use Testimony sockets by prefixing them with testimony:: on the command line. For example, to use Testimony to get packets from socket/tmp/testimony.sock:

# zeek -i testimony::/tmp/testimony.sock

Environment variables are used for setting fanout index:

# TESTIMONY_FANOUT_ID=2 /usr/local/zeek/bin/zeek -i testimony::/tmp/testimony.sock

Usage with zeekctl

To use the AF_Packet plugin with zeekctl, the custom load balance method can be utilized. The following shows an exemplary configuration :

[manager]
type=manager
host=localhost

[proxy-1]
type=proxy
host=localhost

[worker-1]
type=worker
host=localhost
interface=testimony::/tmp/testimony.sock
lb_method=custom
lb_procs=1
pin_cpus=1
env_vars=TESTIMONY_FANOUT_ID=0

[worker-2]
type=worker
host=localhost
interface=testimony::/tmp/testimony.sock
lb_method=custom
lb_procs=1
pin_cpus=2
env_vars=TESTIMONY_FANOUT_ID=1

If all interfaces using lb_method=custom should be configured for Testimony, the prefix can be globally definied by adding the following line to zeekctl.conf:

lb_custom.InterfacePrefix=testimony::