Zeek Is not Extracting network traffic.

[akshay91999]

I just created an http server remotely and tried to download a pdf from that server to my sensor node.Expected to be the file to be extracted in the /nsm/zeek/extracted but am not getting any file there (tried with .bat file also ).Please provide a solution that will help me to extract the file through traffic. am using security onion 2.3.260.

with regards
Akshay

[dougburks]

Here are some things you can check which might help you figure out what's going on.

• Check to see if you have Strelka enabled and running. If so, it may be processing the extracted file and moving it to a different directory.
• Go to SOC Dashboards and select the HTTP dashboard. See if you can find the HTTP transaction for the file download. If so, choose the Correlate option and see if you can find a related Zeek file entry.
• Check to see if there is any packet loss in the upstream tap/span, on the NIC, or in Zeek itself. Packet loss can prevent file extraction.

[akshay91999]

strelka is running and i already checked in their unprocessed and processed folder but the file is not coming to there also.
one thing i noted is tcpdump on bond0 doesnt gives any output for port 80 traffic and no log file is created for http in the /nsm/zeek/log folder

[dougburks]

If tcpdump doesn't show the traffic, then it's most likely not a Security Onion problem at all. Double-check your tap/span configuration and wiring.