Google Git
Sign in
apache / metron / apache-metron-0.3.1-rc1-incubating / . / metron-platform / metron-api
tree: 693998750c8828185bb9c510272aecdb678269c5 [path history] [tgz]
  1. src/
  2. pom.xml
  3. README.md
metron-platform/metron-api/README.md

Metron PCAP Service

The purpose of the Metron PCAP service is to provide a middle tier to negotiate retrieving packet capture data which flows into Metron. This packet data is of a form which libpcap based tools can read.

Starting the Service

You can start the service either via the init.d script installed, /etc/init.d/pcapservice or directly via the yarn jar command: yarn jar $METRON_HOME/lib/metron-api-$METRON_VERSION.jar org.apache.metron.pcapservice.rest.PcapService -port $SERVICE_PORT -query_hdfs_path $QUERY_PATH -pcap_hdfs_path $PCAP_PATH

where

  • METRON_HOME is the location of the metron installation
  • METRON_VERSION is the version of the metron installation
  • SERVICE_PORT is the port to bind the REST service to.
  • QUERY_PATH is the temporary location to store query results. They are deleted after the service reads them.
  • PCAP_PATH is the path to the packet data on HDFS

The /pcapGetter/getPcapsByIdentifiers endpoint

This endpoint takes the following query parameters and returns the subset of packets matching this query:

  • srcIp : The source IP to match on
  • srcPort : The source port to match on
  • dstIp : The destination IP to match on
  • dstPort : The destination port to match on
  • startTime : The start time in milliseconds
  • endTime : The end time in milliseconds
  • numReducers : Specify the number of reducers to use when executing the mapreduce job
  • includeReverseTraffic : Indicates if filter should check swapped src/dest addresses and IPs

The /pcapGetter/getPcapsByQuery endpoint

This endpoint takes the following query parameters and returns the subset of packets matching this query. This endpoint exposes Stellar querying capabilities:

  • query : The Stellar query to execute
  • startTime : The start time in milliseconds
  • endTime : The end time in milliseconds
  • numReducers : Specify the number of reducers to use when executing the mapreduce job

Example: curl -XGET "http://node1:8081/pcapGetter/getPcapsByQuery?query=ip_src_addr+==+'192.168.66.121'+and+ip_src_port+==+'60500'&startTime=1476936000000"

All of these parameters are optional. In the case of a missing parameter, it is treated as a wildcard.

Unlike the CLI tool, there is no paging mechanism. The REST API will stream back data as a single file.