run another instance of Packetbeat that captures only HTTP traffic on 9200 and writes the output to a file.
What do I need to capture? Only the packets with source 217 and destination 247? Do I need the replies? Do I need packets from 217 with destination 255?
Update: I ran Packetbeat on the Elasticsearch machine. I filtered packets by IP like above:
processors.0.drop_event.when:
and:
- or:
- not.equals.source.ip: xx.xx.xx.217
- not.equals.dest.ip: xx.xx.xx.247
- or:
- not.equals.source.ip: xx.xx.xx.247
- not.equals.dest.ip: xx.xx.xx.217
and dumped its output to file with "output.file.enabled: true".
This is what I got:
{
"@timestamp": "2018-01-18T10:18:50.014Z",
"@metadata": {
"beat": "packetbeat",
"type": "doc",
"version": "6.1.1"
},
"source": {
"mac": "aa:bb:cc:dd:ee:ff",
"ip": "xx.xx.xx.217",
"port": 61029,
"stats": {
"net_packets_total": 19,
"net_bytes_total": 25137
}
},
"last_time": "2018-01-18T10:18:41.470Z",
"type": "flow",
"flow_id": "EQQA////DP//////FP8BAAEADCnCS/4ADCnNNtFSYcn3UmHJ2fAjZe4",
"beat": {
"name": "lab247",
"hostname": "lab247",
"version": "6.1.1"
},
"final": false,
"transport": "tcp",
"dest": {
"mac": "00:11:22:33:44:55",
"ip": "xx.xx.xx.247",
"port": 9200,
"stats": {
"net_packets_total": 4,
"net_bytes_total": 854
}
},
"start_time": "2018-01-18T10:18:40.969Z"
}
{
"@timestamp": "2018-01-18T10:19:00.048Z",
"@metadata": {
"beat": "packetbeat",
"type": "doc",
"version": "6.1.1"
},
"type": "flow",
"flow_id": "EQQA////DP//////FP8BAAEADCnCS/4ADCnNNtFSYcn3UmHJ2fAjZe4",
"transport": "tcp",
"beat": {
"name": "lab247",
"hostname": "lab247",
"version": "6.1.1"
},
"dest": {
"stats": {
"net_bytes_total": 2448,
"net_packets_total": 11
},
"mac": "00:11:22:33:44:55",
"ip": "xx.xx.xx.247",
"port": 9200
},
"last_time": "2018-01-18T10:18:51.547Z",
"final": false,
"source": {
"mac": "aa:bb:cc:dd:ee:ff",
"ip": "xx.xx.xx.217",
"port": 61029,
"stats": {
"net_packets_total": 53,
"net_bytes_total": 70520
}
},
"start_time": "2018-01-18T10:18:40.969Z"
}
{
"@timestamp": "2018-01-18T10:19:10.043Z",
"@metadata": {
"beat": "packetbeat",
"type": "doc",
"version": "6.1.1"
},
"final": false,
"transport": "tcp",
"source": {
"stats": {
"net_packets_total": 100,
"net_bytes_total": 134536
},
"mac": "aa:bb:cc:dd:ee:ff",
"ip": "xx.xx.xx.217",
"port": 61029
},
"dest": {
"port": 9200,
"stats": {
"net_packets_total": 28,
"net_bytes_total": 4771
},
"mac": "00:11:22:33:44:55",
"ip": "xx.xx.xx.247"
},
"start_time": "2018-01-18T10:18:40.969Z",
"type": "flow",
"beat": {
"name": "lab247",
"hostname": "lab247",
"version": "6.1.1"
},
"flow_id": "EQQA////DP//////FP8BAAEADCnCS/4ADCnNNtFSYcn3UmHJ2fAjZe4",
"last_time": "2018-01-18T10:19:01.520Z"
}
{
"@timestamp": "2018-01-18T10:19:20.044Z",
"@metadata": {
"beat": "packetbeat",
"type": "doc",
"version": "6.1.1"
},
"start_time": "2018-01-18T10:18:40.969Z",
"last_time": "2018-01-18T10:19:11.515Z",
"type": "flow",
"final": false,
"transport": "tcp",
"dest": {
"port": 9200,
"stats": {
"net_bytes_total": 6840,
"net_packets_total": 42
},
"mac": "00:11:22:33:44:55",
"ip": "xx.xx.xx.247"
},
"flow_id": "EQQA////DP//////FP8BAAEADCnCS/4ADCnNNtFSYcn3UmHJ2fAjZe4",
"source": {
"port": 61029,
"stats": {
"net_bytes_total": 188232,
"net_packets_total": 140
},
"mac": "aa:bb:cc:dd:ee:ff",
"ip": "xx.xx.xx.217"
},
"beat": {
"hostname": "lab247",
"version": "6.1.1",
"name": "lab247"
}
}
{
"@timestamp": "2018-01-18T10:19:30.049Z",
"@metadata": {
"beat": "packetbeat",
"type": "doc",
"version": "6.1.1"
},
"dest": {
"ip": "xx.xx.xx.247",
"port": 9200,
"stats": {
"net_packets_total": 59,
"net_bytes_total": 9053
},
"mac": "00:11:22:33:44:55"
},
"type": "flow",
"final": false,
"beat": {
"name": "lab247",
"hostname": "lab247",
"version": "6.1.1"
},
"source": {
"mac": "aa:bb:cc:dd:ee:ff",
"ip": "xx.xx.xx.217",
"port": 61029,
"stats": {
"net_packets_total": 180,
"net_bytes_total": 241928
}
},
"start_time": "2018-01-18T10:18:40.969Z",
"last_time": "2018-01-18T10:19:21.515Z",
"flow_id": "EQQA////DP//////FP8BAAEADCnCS/4ADCnNNtFSYcn3UmHJ2fAjZe4",
"transport": "tcp"
}
{
"@timestamp": "2018-01-18T10:19:40.044Z",
"@metadata": {
"beat": "packetbeat",
"type": "doc",
"version": "6.1.1"
},
"flow_id": "EQQA////DP//////FP8BAAEADCnCS/4ADCnNNtFSYcn3UmHJ2fAjZe4",
"beat": {
"name": "lab247",
"hostname": "lab247",
"version": "6.1.1"
},
"source": {
"ip": "xx.xx.xx.217",
"port": 61029,
"stats": {
"net_packets_total": 220,
"net_bytes_total": 295549
},
"mac": "aa:bb:cc:dd:ee:ff"
},
"start_time": "2018-01-18T10:18:40.969Z",
"type": "flow",
"last_time": "2018-01-18T10:19:31.519Z",
"final": false,
"transport": "tcp",
"dest": {
"port": 9200,
"stats": {
"net_packets_total": 74,
"net_bytes_total": 11160
},
"mac": "00:11:22:33:44:55",
"ip": "xx.xx.xx.247"
}
}