{"id":81199,"date":"2020-05-11T19:42:01","date_gmt":"2020-05-11T17:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/aol-opublikoval-sistemu-indeksaczii-setevogo-trafika-moloch-2-3"},"modified":"2020-05-11T19:42:01","modified_gmt":"2020-05-11T17:42:01","slug":"aol-opublikoval-sistemu-indeksaczii-setevogo-trafika-moloch-2-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/aol-opublikoval-sistemu-indeksaczii-setevogo-trafika-moloch-2-3","title":{"rendered":"AOL has released the Moloch 2.3 network traffic indexing system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

AOL Inc. released<\/a><\/noindex> a system for capturing, storing, and indexing network packets Moloch 2.3<\/a><\/noindex>, providing tools for visually assessing traffic streams and finding information related to network activity. The code is written in C (with an interface in Node.js\/JavaScript) and is distributed<\/a><\/noindex> is licensed under Apache 2.0. It supports operation in Linux and FreeBSD. Pre-packaged packages<\/a><\/noindex> are prepared for various versions of CentOS and Ubuntu.<\/p>\n

The project was initiated in 2012 with the aim of creating an open-source alternative to commercial network packet processing platforms, capable of scaling to handle traffic levels similar to those of AOL. Implementing the new system at AOL allowed for complete control over the infrastructure by deploying it on their own servers and significantly reducing costs \u2014 using Moloch for full traffic capture across all AOL networks cost about the same as using on a commercial solution<\/a><\/noindex> that was exclusively capturing traffic in a single network. The system can scale to handle traffic at speeds of tens of gigabits per second. The volume of stored data is limited only by the size of the available storage array.
\nSession metadata is indexed in a cluster based on the engine Elasticsearch<\/a><\/noindex>.<\/p>\n

Moloch includes tools for capturing and indexing traffic in standard PCAP format, as well as for quick access to indexed data. For analyzing the accumulated information, a web interface is provided, allowing for navigation, search, and export of samples. It also offers API<\/a><\/noindex>, which enables the transfer of data about captured packets in PCAP format and parsed sessions in JSON format to third-party applications. The use of the PCAP format significantly simplifies integration with existing traffic analyzers such as Wireshark.<\/p>\n

Moloch consists of three basic components:<\/p>\n