如何使用Bro Network Security Monitor监视视频和https流量 [英] How to monitor video and https traffic using bro network security monitor

问题描述

我已经在系统上成功配置了bro.操作系统是centos7.我必须控制多媒体流量，例如youtube和一些社交网站，例如facebook.我在使用facebook和youtube时开始做一些细微的修改，但是在http日志文件nithir facebook中它们不是关于youtube的信息.至于我认为这是一个协议问题，因为facebook使用https而不是http，但是我不知道为什么要使用youtube.

I have configured bro on my system successfully. OS is centos 7. I have to monotor multimedia traffic e.g. youtube and some social site like facebook. I started bro for some miniutes while using facebook and youtube but their is no information about youtube in http log file nithir facebook. As for I think that this is a protocol problem as facebook use https rather than http but I do not know why youtube.

设置正确的界面后，我已按照以下步骤操作.

I have followed following steps after setting correct interface.

[BroControl] > install

然后

[BroControl] > start

但是我没有在http.log中找到任何youtube或facebook信息.如何获得此类网站的流量信息?

But I have not found any youtube or facebook info in http.log. How to get traffic info of such websites?

推荐答案

问题是您期望SSL加密的流量能够被神奇地解密并出现在您的http.log中.如果再看一遍，您会发现YouTube也在HTTPS上运行.

The problem is that you are expecting SSL encrypted traffic to be magically decrypted and appear in your http.log. If you look again, you will find that YouTube also runs over HTTPS.

除非您正在做一些事情来拦截并充当SSL/TLS连接的中间人，否则您不能指望能够看到其内容.如果看不到，兄弟也看不到. :)

Unless you are doing something to intercept and act as a man-in-the-middle for the SSL/TLS connections, you cannot expect to be able to see the content. If you can't see it, Bro can't see it either. :)

如果要验证是否已正确配置，最好查看conn.log来验证是否正在建立连接.完成此操作后，在其他日志中搜索UID值，我强烈怀疑您会发现自己正在查找SSL证书数据.

If you want to verify that you are properly configured, you would be best served looking at the conn.log to verify that the connections are occurring. Once you do that, search for the UID values in the other logs and I strongly suspect that you will see that you are finding SSL certificate data.

这篇关于如何使用Bro Network Security Monitor监视视频和https流量的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！