Stop traffic capture by specific sensors

[Cantondy]

Hello,

In a distributed deployment, I would like to stop traffic capture for a specific probe for a given time. Which command can do this?

I've tested “so-stop zeek” but the service restarts itself afterwards. I'm not sure if I should also stop Suricatta or another one.

Thanks in advance

[cm-ops]

If you want to disable the service for a while, you can do that in the GUI -> SOC -> Administration -> Configuration -> Service -> enabled -> false Just make sure you select the node you want to disable the service on and set that node only.

Otherwise, you could just bring the bond0 interface down with NetworkManager if it for a short period of time.

[Cantondy]

Thank you for your reply. Disabling the service via the GUI works perfectly.

The trick of disabling the network interface is also a good temporary solution.

Thank you !