v0.5
Metrics
Prometheus Metrics
Introduction
Netcap now supports exporting prometheus metrics about its go runtime, the collection process and the audit records itself. These data points can be used to gain insights about the collection performance or discover security related events.
​Prometheus is an open-source systems monitoring and alerting toolkit originally built at SoundCloud. Since its inception in 2012, many companies and organizations have adopted Prometheus, and the project has a very active developer and user community. It is now a standalone open source project and maintained independently of any company.
Prometheus - Monitoring system & time series database
Prometheus Homepage
To visualize the captured data I recomment the open source analytics and monitoring solution Grafana:
Grafana® Features
Grafana Labs
Grafana Homepage
This feature can be used with the export tool, which behaves similar to capture but is able to operate on pcaps, audit records and network interfaces.
Configuration
Metrics are served by default on 127.0.0.1:7777/metrics. Configure a prometheus instance to scrape it:
1
# reference: https://prometheus.io/docs/prometheus/latest/configuration/configuration/
2
​
3
global:
4
scrape_interval: 15s
5
scrape_timeout: 15s
6
#evaluation_interval: 15s
7
​
8
scrape_configs:
9
# process_ metrics
10
- job_name: netcap
11
metrics_path: /metrics
12
scheme: http
13
static_configs:
14
- targets:
15
- 127.0.0.1:7777
Copied!
Tip: The latest prometheus config documentation can be found at: https://prometheus.io/docs/prometheus/latest/configuration/configuration​
Run the export tool to capture live from an interface:
1
net export -iface en0
Copied!
Tip: Use
$ net capture -interfaces to get a list of available interfaces to choose fromGo to http://localhost:9090 or to the port you configured alternatively, to check if your prometheus instance is scraping data correctly. Now that we have some data at hands, lets use Grafana to visualize it!
You can setup Grafana on macOS via brew:
1
$ brew install grafana
Copied!
Tip: On macOS, Grafanas default config is at /usr/local/etc/grafana/grafana.ini and installed plugins are stored at /usr/local/opt/grafana/share/grafana/data/plugins.
Start the prometheus server and pass the previously created config:
1
$ prometheus --config.file prometheus/prometheus.yml
Copied!
You need to install the pie chart plugin for grafana:
1
$ cd /usr/local/opt/grafana/share/grafana/data/plugins
2
$ git clone https://github.com/grafana/piechart-panel.git --branch release-1.4.0
Copied!
Start the grafana server:
1
$ grafana-server --homepath /usr/local/opt/grafana/share/grafana
Copied!
Now download the NETCAP Dashboard and import it into Grafana:
NETCAP-1587637598999.json
137KB
Code
Go to Settings > Datasources and a prometheus datasource, either with the default port 9090 or the one you choose in the config.
You should be good to go!
Usage
Export a PCAP dumpfile and serve metrics .
1
$ net export -read 2017-09-19-traffic-analysis-exercise.pcap
Copied!
Capture and export traffic live from the named interface:
1
$ net export -iface en0
Copied!
Export a specific audit record file:
1
$ net export -read HTTP.ncap.gz
Copied!
Export all audit record files in the current directory:
1
$ net export .
Copied!
Overview Dashboard Preview
Grafana Dashboard Overview
TCP Dashboard Preview
Grafana Dashboard TCP
HTTP Dashboard Preview
Grafana Dashboard HTTP
Last modified 2yr ago