Digital Evedance
Packet Forensics and Analytics

Moloch Packet Analytics

Project Name:  Moloch Packet Analytics
Description: Moloch Packet Analytics includes understanding MOLOCH and Elasticsearch to a great extent. Packet Forensics and Analytics will help you to understand MOLOCH for Packet Analytics & Elasticsearch for forensics indexing for packet. Both will perform this activity in Real Time so as to resolve many issues like DOS attack, DDOS Attack, Insider Threats, Access Intelligence, Bandwidth Issue and many more..

Author: Rohit D Sadgune

Summary of Content

  1. MOLOCH Concept
  2. Architecture of MOLOCH
  3. Installation of MOLOCH & Elasticsearch

MOLOCH Concept

MOLOCH Introduction:

MOLOCH is an open source having a huge scale of IPv4 packet Analytics view. MOLOCH can index PCAP file for further packet forensics analysis and give a analytical view to end user. On behalf of the packet forensics index we can easily search, which reduces the time & increases the efficiency in security operation center or forensics investigation.

The MOLCH is build to capture every packet which is getting transmitted over the network and it integrates the elasticsearch for indexing purpose. Finally data can be exported in PCAP/CSV format for further analysis.

Specific Details about MOLOCH:

  1. This is not an IDS.
  2. No support for IPv6 till date.

Components of MOLOCH:

  1. Capture
  • A C language application that sniffs the network interface, parses the traffic, and creates the Session Profile Information (SPI data) and writes it to disk

 

Moloch Packet Analytics
Moloch Packet Analytics
Moloch Packet Analytics
Moloch Packet Analytics

 

  1. DB (Elasticsearch)
  • Elasticsearch is used for forensics indexing i.e storing and searching through the SPI data generated by the capture component.
  • Powered by Apache Lucene (http://lucene.apache.org)
  • Requests over HTTP(s)
  • Results returned in JSON
  • Network traffic doesn’t fit the mould for relational DBs. (So no SQL is used)
  • Data can automatically be shared between various platforms.
  1. Viewer
  • A web interface that allows for GUI and API access from remote hosts to browse or query SPI data and retrieve stored PCAP.

Note: – Capture & Viewer should be on same machine.

Architecture of MOLOCH

Architecture of MOLOCH
Architecture of MOLOCH

Architecture of MOLOCH multi node with cluster

Architecture of MOLOCH multinode with cluster
Architecture of MOLOCH multinode with cluster 

Details On Elasticsearch

Elasticsearch work on Apache2, IT works on distributed structure where it starts with one system and gets deployed over hundreds of systems.

MOLOCH SPI datatype session profile information

Moloch datatype -Moloch Packet Analytics
Moloch datatype – Moloch Packet Analytics
Moloch datatype - Moloch Packet Analytics
Moloch datatype – Moloch Packet Analytics

 

 

Back to Packet Analytics

 

Packet Analytics
Packet Forensics and Analytics
Packet Analytics

Packet Analytics Project Name: Packet Analytics Description: Packet Analytics includes understanding Packet. Both will perform this activity in Real Time so as to resolve many issues like DOS attack, DDOS Attack, Insider Threats, Access Intelligence, Bandwidth Issue and many more. Author: Rohit D Sadgune Frequently Asked Question on MOLOCH Packet …

Live Evidence Invetigation
Packet Forensics and Analytics
Installation of MOLOCH

Installation of MOLOCH Project Name: Installation of MOLOCH Description: Packet Analytics includes understanding MOLOCH and Elasticsearch to great extent. In this blog we will try to figure out step by step installation of MOLOCH for Packet Analytics & Packet Forensics. Packet Forensics and Analytics will help you understand MOLOCH for …

MOLOCH Usage
Packet Forensics and Analytics
Moloch Usage

Moloch Usage Project Name: Moloch Usage Description: Moloch Usage includes understanding packet with respect to system level components, GUI views of MOLOCH Packet Analytics and MOLOCH Use Case. Author: Rohit D Sadgune Summary of Content System Level Concepts of MOLOCH Important Files & Folders Working with MOLOCH USE cases of …

%d bloggers like this: