Moloch is an open source PCAP capturing, indexing, and database system maintained by AOL with source hosted on GitHub.
With Moloch you can capture full PCAPs of traffic sessions on your network, search through and filter the resultant session metadata, and export PCAPs based on session, time period, or both. In addition, Moloch enriches session metadata by utilizing MaxMind GeoIP to geolocate IP addresses.
Moloch consists of three main components:
- A single-threaded capture process which runs per network interface. One machine can run multiple processes if monitoring multiple interfaces.
- A viewer application built using node.js containing the user interface and PCAP transfer functionality.
These components can be deployed on a single machine or across multiple hosts.
The GitHub repository contains an
easybutton-config.sh script for quickly
Single Host Install
To get Moloch up and running, perform the following steps on a Linux system:
git clone https://github.com/aol/moloch.gitto clone the Moloch repo.
sudo moloch/easybutton-singlehost.shto kick off the installation. The script will use
wgetto get its dependencies.
- Start Elasticsearch:
- Start the capture process:
sudo nohup /data/moloch/bin/run_capture.sh &
- Start the viewer process:
sudo nohup /data/moloch/bin/run_viewer.sh &
The web interface will be available on port 8005 after starting the viewer process. If the capture process on your Moloch host is listening on the same interface that the viewer is bound to then you should begin to see traffic sessions appear in the “Sessions” tab.
If traffic does not begin to appear in the “Sessions” tab of the web interface
then you can check the logs located at
/data/moloch/logs/. When I first
started Elasticsearch, the viewer process, and the capture process my
capture.log contained the following:
May 1 23:14:07 http.c:237 moloch_http_connect(): Connecting 0x7f29208a6010 localhost:9200 May 1 23:14:07 http.c:277 moloch_http_connect(): 0x7f29208a6010: Error: Address family not supported by protocol May 1 23:14:07 http.c:553 moloch_http_create(): Couldn't connect to 'localhost:9200'
Elasticsearch uses port 9200, so this log message indicates that the capture
process could not connect to the Elasticsearch instance. To fix this, I edited
the Elasticsearch config line in
elasticsearch=127.0.0.1:9200 and started
the capture process again.