Zeek notice.log

[yula-21]

Hi,
Im trying to use zeek to alert when unknown traffic (outside of a baseline traffic I’ve created).
The problem is that the notice.log under /nsm/zeek/logs/current shows the following:

“note”:”CaptureLoss::Too_Little_Traffic”,”msg”:”Only observed 0 TCP ACKs and was expecting at least 1.”,”peer_descr”:”worker-1-2”,”actions”:”[“Notice::ACTION_LOG”]

“note”:”CaptureLoss::Too_Little_Traffic”,”msg”:”Only observed 0 TCP ACKs and was expecting at least 1.”,”peer_descr”:”worker-1-1”,”actions”:”[“Notice::ACTION_LOG”]

The monitoring interface does get traffic so I don't understand why it says Too_Little_Traffic
I even tried to use tcpreplay on the monitoring interface to make sure that traffic not flowing is not the issue.

Does anyone have any idea what could cause the CaptureLoss message?

[dougburks]

How did you configure the system?

Is the system connected to a tap or span port?

How did you verify that the monitoring interface is receiving traffic?

How much traffic is it receiving?

[dougburks]

If you are just running a periodic tcpreplay or if there are gaps in the pcap file, then it may be entirely possible that there are windows of time where no traffic hits the sniffing interface. If that's the case, then the Zeek notice is correct and nothing to be concerned about.

[yula-21]

Thank you for your reply, I checked and what you’re saying is true.
The only problem I am still seeing is that the traffic flowing to zeek seems to skip certain ip addresses, I am getting traffic from a single subnet.
Is there a configuration file where it could be set to get traffic from certain subnets?

[dougburks]

You could check and see if there is a BPF defined:
https://docs.securityonion.net/en/2.3/bpf.html

If you have further questions or problems, please start a separate discussion rather than replying to this Zeek notice.log discussion which is now marked as answered.

[gdianq]

If you are just running a periodic tcpreplay or if there are gaps in the pcap file, then it may be entirely possible that there are windows of time where no traffic hits the sniffing interface. If that's the case, then the Zeek notice is correct and nothing to be concerned about.

I am new to zeek and I have encountered this problem recently. How to solve this problem?

[dougburks]

If you are just running a periodic tcpreplay or if there are gaps in the pcap file, then it may be entirely possible that there are windows of time where no traffic hits the sniffing interface. If that's the case, then the Zeek notice is correct and nothing to be concerned about.

@gdianq If you are asking about this snippet that you copied, then it is not a problem and that's explained in the second sentence. If you have other questions or problems, please start a new discussion rather than replying to somebody else's discussion.