in ,

AOL Moloch: open-source, large scale, packet-capturing, indexing database system, Hacker News





            Large scale, open source, indexed packet capture and search.           





          Augment your current security infrastructure to store and           index network traffic in standard PCAP format.           

          Moloch is not meant to replace Intrusion Detection Systems (IDS),           instead it provides more visibility.         






              Access to Moloch is protected by using HTTPS with digest passwords or               by using an authentication providing web server proxy. All PCAPs are               stored on the installed Moloch sensors and are only available through the Moloch               web interface or API. Moloch supports encrypting PCAP files at rest.             


              Want to report a security issue or just learn more? There’s                                more info here .             






              Moloch is designed to be deployed across multiple clustered               systems providing the ability to scale to handle multiple               gigabits per second of traffic. PCAP retention is based on               available sensor disk space while metadata retention is               based on the scale of the Elasticsearch cluster.               Both can be increased at anytime.             






              A web application is provided for PCAP browsing,               searching, analysis, and PCAP carving for exporting. Moloch               stores and exports all packets in standard PCAP format               allowing you to use your favorite PCAP ingesting tools               during your analysis workflow.             










              The Sessions page displays a list of indexed sessions for the selected time period and search expression.               It includes a timeline graph and map of the session results.             


Sessions screenshot



              Sessions screenshot                              Search             


              The search bar allows for powerful search queries to narrow down the data.               Click the owl for available fields.             


              Sessions screenshot                              Session detail             


              Get more information about any session and view the session’s               packet data by clicking the ” ” button.             


              Sessions screenshot                              Value actions             


              Hover and click any value to view a dropdown menu of actions, like               applying that value as search criteria.             


              Sessions screenshot                              Export PCAP             


              You can export search results as PCAP or CSV by clicking the “Actions”               ( drop down menu on the top right .             


              Sessions screenshot                              Timeline search             


              Click and drag an area in the timeline to filter sessions by time.             


              Sessions screenshot                              Country search             


              Click a country on the map to apply it as search criteria.             








              The SPI (Session Profile Information) View page allows you to view unique values ​​with session counts for each of the captured fields.             




              Sessions screenshot                              Toggle categories             


              Click on any section to open or close any field category.             


              Sessions screenshot                              Search for fields             


              Search for fields within a category by using the input box within a category.             


              Sessions screenshot                              Toggle fields             


              Click on a field in the top section of a category to toggle the field’s visibility.               You can also click the load / unload all buttons to load / unload all the fields               in that category.             


              Sessions screenshot                              Cancel Load             


              Click the cancel button on the top right of the page if the               page is taking a long time load data or you made a mistake when               you issued a query.             








              The SPI (Session Profile Information) Graph page shows a temporal view for the top unique values ​​of any field.             




              Sessions screenshot                              Total             


              The first timeline graph and map shows an aggregation of all the results below.               Click on the “x” button on this map to hide all maps.             


              Sessions screenshot                              Search for fields             


              Make a selection from the SPI Graph drop down on the top left               to view the unique values ​​for different fields.             


              Sessions screenshot                              More fields             


              Change the number of Max Elements to display more results.             


              Sessions screenshot                              Sorting             


              Change the sort by dropdown to change how the results are sorted.               By default, the results are sorted starting with the highest unique               field value.             








              The Connections page shows a network graph of your search results.             


SPI View screenshot



              Sessions screenshot                              Lock             


              Click and drag a node to lock it into place in the graph.             


              Sessions screenshot                              Node Info             


              Hover over a node or a link to view more information (or hide it).             


              Sessions screenshot                              Node / Link Weight             


              Change the Node / Link Weight dropdown to change how the node and link               sizes are calculated.             


              Sessions screenshot                              Change Source / Destination Nodes             


              Make a selection from the Src and Dst drop downs to visualize your data based               Upon different captured field relationships.             









            Connections screenshot               Sessions screenshotSessions screenshot               Loading Moloch downloads …                                                               










            Join our                            Slack                          workspace to discuss Moloch and ask questions.           




            Community Feedback           

          Have feedback about the Moloch community? Tell us what you think                        here .         






          Want to add to our FAQ?           Found an issue in this site?         


          Sessions screenshot                      This site’s code is open source.                        Please contribute!                      Sessions screenshot                    




(Read More)

What do you think?

Leave a Reply

Your email address will not be published.

GIPHY App Key not set. Please check settings

Out of the Crisis, Hacker News

There seems to be no pattern to where humans pick up new viruses, Ars Technica

There seems to be no pattern to where humans pick up new viruses, Ars Technica