forked from arkime/arkimeweb
-
Notifications
You must be signed in to change notification settings - Fork 0
/
settings.html
5186 lines (5119 loc) · 173 KB
/
settings.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
---
title: Settings
---
<!DOCTYPE html>
<html lang="en" style="height:100%;">
<head>
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-137788272-1"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag() {
dataLayer.push(arguments);
}
gtag('js', new Date());
gtag('config', 'UA-137788272-1');
</script>
<title>Arkime Settings</title>
<!-- Required meta tags always come first -->
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
<meta http-equiv="x-ua-compatible" content="ie=edge" />
<meta name="description" content="Arkime settings" />
<!-- facebook open graph tags -->
<meta property="og:url" content="http://arkime.com/settings" />
<meta property="og:description" content="Arkime settings" />
<meta property="og:image" content="http://arkime.com/assets/[email protected]" />
<!-- twitter card tags additive with the og: tags -->
<meta name="twitter:card" content="summary" />
<meta name="twitter:domain" value="arkime.com" />
<meta name="twitter:description" value="Frequently asked Arkime questions" />
<meta name="twitter:image" content="http://arkime.com/assets/[email protected]" />
<meta name="twitter:url" value="http://arkime.com/settings" />
<!-- fontawesome http://fontawesome.io/ -->
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css">
<!-- Bootstrap CSS https://getbootstrap.com/ -->
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/bootstrap.min.css">
<!-- custom index page styles -->
<link rel="stylesheet" type="text/css" href="index.css">
<!-- page functions -->
<script src="index.js"></script>
</head>
<body id="viewport"
class="full-height-body">
<!-- navbar -->
{%- include navbar.html -%}
<!-- toc nav -->
<div class="left-nav d-none d-sm-block">
<div class="nav nav-pills nav-pills-nested pb-3">
<a href="#ini-settings"
class="nav-link"
title="General">
INI Settings
</a>
<a class="nav-link nested"
href="#basic-settings"
title="Basic Settings">
Basic Settings
</a>
<a class="nav-link nested"
href="#advanced-settings"
title="Advanced Settings">
Advanced Settings
</a>
<a class="nav-link nested nested-more"
href="#packet-deduplication-settings"
title="Packet Deduplication Settings">
Packet Deduplication Settings
</a>
<a class="nav-link nested nested-more"
href="#reader-tpacketv3-settings"
title="Reader tpacketv3 Settings">
Reader tpacketv3 Settings
</a>
<a class="nav-link nested nested-more"
href="#reader-daq-settings"
title="Reader daq Settings">
Reader daq Settings
</a>
<a class="nav-link nested nested-more"
href="#reader-pfring-settings"
title="Reader pfring Settings">
Reader pfring Settings
</a>
<a class="nav-link nested nested-more"
href="#reader-snf-settings"
title="Reader snf Settings">
Reader snf Settings
</a>
<a class="nav-link nested nested-more"
href="#reader-poi-settings"
title="Reader PCAP-Over-Ip Settings">
Reader PCAP-Over-Ip Settings
</a>
<a class="nav-link nested nested-more"
href="#writer-s3-settings"
title="Writer S3 Settings">
Writer S3 Settings
</a>
<a class="nav-link nested"
href="#debug-settings"
title="Debug Settings">
Debug Settings
</a>
<a class="nav-link nested"
href="#custom-fields"
title="custom-fields">
custom-fields
</a>
<a class="nav-link nested"
href="#custom-views"
title="custom-views">
custom-views
</a>
<a class="nav-link nested"
href="#moloch-clusters"
title="moloch-clusters">
moloch-clusters
</a>
<a class="nav-link nested"
href="#multi-viewer-settings"
title="Multi Viewer Settings">
Multi Viewer Settings
</a>
<a class="nav-link nested"
href="#override-ips"
title="override-ips">
override-ips
</a>
<a class="nav-link nested"
href="#headers-http-request"
title="headers-http-request">
headers-http-request
</a>
<a class="nav-link nested"
href="#headers-http-response"
title="headers-http-response">
headers-http-response
</a>
<a class="nav-link nested"
href="#headers-email"
title="headers-email">
headers-email
</a>
<a class="nav-link nested"
href="#right-click"
title="valueactions">
value actions
</a>
<a class="nav-link nested"
href="#field-actions"
title="fieldactions">
field actions
</a>
<a class="nav-link nested"
href="#packet-drop-ips"
title="packet-drop-ips">
packet-drop-ips
</a>
<a class="nav-link nested"
href="#pcap-at-rest-encryption"
title="PCAP at Rest Encryptions">
PCAP at Rest Encryption
</a>
<a href="#plugins"
class="nav-link"
title="Plugins">
Plugins
</a>
<a class="nav-link nested"
href="#wise"
title="WISE">
WISE
</a>
<a class="nav-link nested"
href="#netflow"
title="Netflow">
Netflow
</a>
<a class="nav-link nested"
href="#suricata"
title="Suricata">
Suricata
</a>
<a class="nav-link nested"
href="#tagger"
title="Tagger">
Tagger
</a>
<a class="nav-link nested"
href="#lua"
title="Lua">
Lua
</a>
<a class="nav-link nested"
href="#tcphealthcheck"
title="TCP Health Check">
TCP Health Check
</a>
<a href="#high-performance-settings"
class="nav-link"
title="High Performance Settings">
High Performance Settings
</a>
</div>
</div> <!-- /toc nav -->
<!-- toc expand/collapse -->
<div class="collapse-btn d-none d-sm-block"
onclick="toggleToc()">
<span class="fa fa-angle-double-left">
</span>
</div> <!-- /toc expand/collapse -->
<!-- settings container -->
<div class="full-height-container">
<!-- settings content -->
<div class="pl-3 pr-3">
<!-- ini settings -->
<h1 id="ini-settings"
class="border-bottom">
INI Settings
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</h1>
<p>
Arkime uses a tiered system for configuration variables. A tiered
system allows Arkime to share one config file for many machines. The
ordering of sections within the config file doesn't matter.
</p>
<p class="mb-0">
Order of config variables:
</p>
<ol>
<li>
[optional] The section titled with the node name is used first.
Arkime will always tag sessions with node: <node name>
</li>
<li>
[optional] If a node has a nodeClass variable, the section titled
with the nodeClass name is used next. Sessions will be tagged with
node:<node class name> which is useful if watching different
network classes.
</li>
<li>
The section titled "default" is used last.
</li>
</ol>
<!-- /ini settings -->
<!-- basic settings -->
<h2 id="basic-settings">
Basic Settings
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</h2>
<table class="table table-bordered table-sm table-striped">
<thead>
<tr>
<th>
Setting
</th>
<th>
Default
</th>
<th>
Description
</th>
</tr>
</thead>
<tbody>
<tr>
<td id="bpf">
bpf
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
The bpf filter used to reduce traffic. Used both on live and file
traffic.
</td>
</tr>
<tr>
<td id="businessDayStart">
businessDayStart
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
If both businessDayStart and businessDayEnd are set, it displays a
colored background on the sessions timeline graph during business hours.
Values are in hours from midnight UTC. For example: 9am EST would be 13.
</td>
</tr>
<tr>
<td id="businessDayEnd">
businessDayEnd
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
If both businessDayStart and businessDayEnd are set, it displays a
colored background on the sessions timeline graph during business hours.
Values are in hours from midnight UTC. For example: 5pm EST would be 21.
</td>
</tr>
<tr>
<td id="businessDays">
businessDays
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
1,2,3,4,5
</td>
<td>
Displays a colored background on the sessions timeline graph on
only these days. businessDayStart and businessDayEnd must be set
for these to be of use. Values are comma separted list of days of
the week as numbers. The week starts at Sunday = 0 and ends on
Saturday = 6. For example: Monday through Friday would be 1,2,3,4,5
</td>
</tr>
<tr>
<td id="certfile">
certFile
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Public certificate to use for https, if not set then http will be
used. keyFile must also be set.
</td>
</tr>
<tr>
<td id="cronqueries">
cronQueries
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
FALSE
</td>
<td>
Set on 1 viewer node per cluster, this viewer node will perform all the cron queries and hunts for the cluster.
If you do NOT set this on a cluster hunts and cron queries can be created but will never run.
<br>
(Since 3.0) If <a href="#userselasticsearch">usersElasticsearch</a> is set, this viewer node will sync shortcuts from the usersElasticsearch to the local OpenSearch/Elasticsearch.
</td>
</tr>
<tr>
<td id="dontsavebpfs">
dontSaveBPFs
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Semicolon ';' separated list of bpf filters which when matched
for a session causes the remaining pcap from being saved for the
session. It is possible to specify the number of packets to save
per filter by ending with a :num. For example
dontSaveBPFs = port 22:5 will only save 5 packets for port
22 sessions. Currently only the initial packet is matched against
the bpfs.
</td>
</tr>
<tr>
<td id="dontsavetags">
dontSaveTags
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Semicolon ';' separated list of tags which once capture sets for
a session causes the remaining pcap from being saved for the
session. It is likely that the initial packets WILL be
saved for the session since tags usually aren't set until after
several packets. It is possible to specify the number of packets
to save per filter by ending with a :num.
</td>
</tr>
<tr>
<td id="dropgroup">
dropGroup
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Group to drop privileges to. The pcapDir must be writable by this
group or to the user specified by dropUser
</td>
</tr>
<tr>
<td id="dropuser">
dropUser
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
User to drop privileges to. The pcapDir must be writable by this
user or to the group specified by dropGroup
</td>
</tr>
<tr>
<td id="esptimeout">
espTimeout
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
600
</td>
<td>
For ESP sessions, Arkime writes a session record after this many
seconds of inactivity since the last session save.
</td>
</tr>
<tr>
<td id="elasticsearch">
elasticsearch
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
http://localhost:9200
</td>
<td>
A comma separated list of urls to use to connect to the OpenSearch/Elasticsearch cluster.
If not using a VIP, a different OpenSearch/Elasticsearch node can be specified for each Arkime node.
If OpenSearch/Elasticsearch requires a user/password those can be placed in the url also, http://user:pass@hostname:port
</td>
</tr>
<tr>
<td id="elasticsearchtimeout">
elasticsearchTimeout
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
300
</td>
<td>
Approximate timeout for most requests to OpenSearch/Elasticsearch.
OpenSearch/Elasticsearch will automatically cancel any request after this expires.
</td>
</tr>
<tr>
<td id="esadminusers">
esAdminUsers
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>EMPTY</td>
<td>
A comma separated list of users that are allowed to use the ES Admin stats tab.
This tab allows the user to change several of the ES settings from the UI.
</td>
</tr>
<tr>
<td id="esclientcert">esClientCert<span class="fa fa-link small copy-link cursor-copy" onclick="copyLink(this, 'settings')"></span></td>
<td>EMPTY</td>
<td>
(Since 2.0) The public key file to use for tls client authentication with OpenSearch/Elasticsearch. Must also set esClientKey.
</td>
</tr>
<tr>
<td id="esclientkey">esClientKey<span class="fa fa-link small copy-link cursor-copy" onclick="copyLink(this, 'settings')"></span></td>
<td>EMPTY</td>
<td>
(Since 2.0) The private key file to use for tls client authentication with OpenSearch/Elasticsearch. Must also set esClientCert.
</td>
</tr>
<tr>
<td id="esclientkeypass">esClientKeyPass<span class="fa fa-link small copy-link cursor-copy" onclick="copyLink(this, 'settings')"></span></td>
<td>EMPTY</td>
<td>
(Since 2.0) The password for the esClientKey setting.
</td>
</tr>
<tr>
<td id="freespaceg">
freeSpaceG
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
5%
</td>
<td>
Delete pcap files when free space is lower then this. This does
NOT delete the session records in the database. It is recommended
this value is between 5% and 10% of the disk. Database deletes
are done by the db.pl expire. Can also be specified using a
percentage.
</td>
</tr>
<tr>
<td id="geoipasnfile">
geoipASNFile
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
(Pre 1.0) Path to the maxmind geoip ASN file.
<a class="no-decoration"
href="http://www.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz"
rel="nofollow">Download free version</a>
</td>
</tr>
<tr>
<td id="geoipfile">
geoipFile
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
(Pre 1.0) Path to the maxmind geoip country file.
<a class="no-decoration"
href="http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz"
rel="nofollow">Download free version</a>
</td>
</tr>
<tr>
<td id="geolite2asn">
geoLite2ASN
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
/usr/share/GeoIP/GeoLite2-ASN.mmdb;/opt/arkime/etc/GeoLite2-ASN.mmdb<br>
(Pre 2.2) /opt/arkime/etc/GeoLite2-ASN.mmdb
</td>
<td>
A Maxmind account is required to use this feature. We recommend installing and setting up the geoipupdate program included with most Linux releases.<br>
(Since 2.2) Semicolon ';' separated list of maxmind geoip country files. The first file found will be used. If no files are found a warning will be issued. To disable warning set to a blank string.<br>
(Since 1.0) Path to the maxmind geoip ASN file.
<a class="no-decoration"
href="https://updates.maxmind.com/app/update_secure?edition_id=GeoLite2-ASN"
rel="nofollow">Download free version</a>
</td>
</tr>
<tr>
<td id="geolite2country">
geoLite2Country
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
/usr/share/GeoIP/GeoLite2-Country.mmdb;/opt/arkime/etc/GeoLite2-Country.mmdb<br>
(Pre 2.2)/opt/arkime/etc/GeoLite2-Country.mmdb
</td>
<td>
A Maxmind account is required to use this feature. We recommend installing and setting up the geoipupdate program included with most Linux releases.<br>
(Since 2.2) Semicolon ';' separated list of maxmind geoip country files. The first file found will be used. If no files are found a warning will be issued. To disable warning set to a blank string.<br>
(Since 1.0) Path to the maxmind geoip country file.
<a class="no-decoration"
href="https://updates.maxmind.com/app/update_secure?edition_id=GeoLite2-Country"
rel="nofollow">Download free version</a>
</td>
</tr>
<tr>
<td id="httprealm">
httpRealm
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
Arkime
</td>
<td>
HTTP Digest Realm - Must be in the default section of
configuration file. Changing the value will cause all previous
stored passwords to no longer work.
</td>
</tr>
<tr>
<td id="icmptimeout">
icmpTimeout
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
10
</td>
<td>
For ICMP sessions, Arkime writes a session record after this
many seconds of inactivity since the last session save.
</td>
</tr>
<tr>
<td id="interface">
interface
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Semicolon ';' separated list of interfaces to listen on for live traffic.
</td>
</tr>
<tr>
<td id="keyfile">
keyFile
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Private certificate to use for https, if not set then http will
be used. certFile must also be set.
</td>
</tr>
<tr>
<td id="magicmode">magicMode<span class="fa fa-link small copy-link cursor-copy" onclick="copyLink(this, 'settings')"></span></td>
<td>
both (since 1.5.0) or libmagic (before 1.5.0)
</td>
<td>
libfile can be VERY slow. Less accurate "magicing" is available for http/smtp bodies:
<ul class="mb-0">
<li>libmagic - normal libmagic</li>
<li>libmagicnotext - libmagic, but turns off text checks</li>
<li>molochmagic - (removed in 1.5.0) subset of libmagic input files, and less accurate</li>
<li>both - (since 1.5.0) try basic and then libmagic</li>
<li>basic - 50+ of most common headers</li>
<li>none - no libmagic or basic calls</li>
</ul>
</td>
</tr>
<tr>
<td id="maxfilesizeg">
maxFileSizeG
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
12 (since 4.0.0)<br>4 (before 4.0)
</td>
<td>
The max raw pcap file size in gigabytes.
The disk should have room for at least 10*maxFileSizeG files.
</td>
</tr>
<tr>
<td id="maxfiletimem">
maxFileTimeM
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
0
</td>
<td>
The max time in minutes between rotating pcap files. Useful if
there is an external utility that needs to look for closed files
every so many minutes. Setting to 0 means only use
maxFileSizeG
</td>
</tr>
<tr>
<td id="maxpackets">
maxPackets
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
10000
</td>
<td>
Arkime writes a session record after this many packets since the
last save. Arkime is only tested at 10k, anything above is not
recommended.
</td>
</tr>
<tr>
<td id="maxpacketsinqueue">
maxPacketsInQueue
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
200000
</td>
<td>
How many packets per packet thread that can be waiting to be processed.
Arkime will stop dropping packets if the queue fills up.
</td>
</tr>
<tr>
<td id="maxstreams">
maxStreams
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
1500000
</td>
<td>
An aproximiate maximum number of active sessions Arkime
will try and monitor
</td>
</tr>
<tr>
<td id="minpacketssavebpfs">
minPacketsSaveBPFs
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
</td>
<td>
Semicolon ';' separated list of bpf filters which
when matched for a session have their SPI data NOT saved to
OpenSearch/Elasticsearch. PCAP data is still saved however. It is possible
to specify the number of min packets required for SPI to be saved
by ending with a :num. A use case is a scanning host inside the
network that you only want to capture if their is a conversation
"tcp and host 10.10.10.10:1".
</td>
</tr>
<tr>
<td id="ouifile">
ouiFile
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
The mac address lookup for manufactures file
<a class="no-decoration"
href="https://raw.githubusercontent.com/wireshark/wireshark/master/manuf"
rel="nofollow">Download free version</a>
</td>
</tr>
<tr>
<td id="packetthreads">
packetThreads
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
1
</td>
<td>
Number of threads to use to process packets AFTER the reader has received the packets.
This also controls how many packet queues there are, since each thread has its own queue.
Basically how much CPU to dedicate to parsing the packets.
Increase this if you get errors about dropping packets or the packetQ is over flowing.
If using the simple writer, this also controls how many pcap files are open for writing.
</td>
</tr>
<tr>
<td id="serversecret">
serverSecret
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
Value of passwordSecret
</td>
<td>
The server-to-server shared key. It must be set in the [default]
section of the config file, and all viewers in the arkime cluster
must have the same value. It can be, and should be changed
periodically.
</td>
</tr>
<tr>
<td id="passwordsecret">
passwordSecret
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Password hash secret - Must be in [default] section of the config file, and all viewers in the arkime cluster must have the same value.
Since OpenSearch/Elasticsearch is wide open by default, we encrypt the stored password hashes with this so a malicious person can't insert a working new account.
It is also used for secure server-to-server communication if serverSecret is not set a different value.
Don't set if you do not want user authentication.
Changing the value will make all previously stored passwords no longer work.
</td>
</tr>
<tr>
<td id="parsecookievalue">
parseCookieValue
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
false
</td>
<td>
Parse HTTP request cookie values, cookie keys are always parsed.
</td>
</tr>
<tr>
<td id="parseqsvalue">
parseQSValue
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
false
</td>
<td>
Parse HTTP query string values, query string keys are always
parsed.
</td>
</tr>
<tr>
<td id="parsesmb">
parseSMB
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
true
</td>
<td>
Parse extra SMB traffic info
</td>
</tr>
<tr>
<td id="parsednsrecordall">
parseDNSRecordAll
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
false
</td>
<td>
(Since 1.6) Parse a full DNS record (query, answer,
authoritative, and additional) and store various DNS information
(look up hostname, name server IPs, mail exchange server IPs, and
so on) into multiple ES fields
</td>
</tr>
<tr>
<td id="parsesmtp">
parseSMTP
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
true
</td>
<td>
Parse extra SMTP traffic info
</td>
</tr>
<tr>
<td id="parsesmtpheaderall">
parseSMTPHeaderAll
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
false
</td>
<td>
(Since 1.6) Parse ALL SMTP request headers not already parsed
using the [headers-email] section
</td>
</tr>
<tr>
<td id="parsehttpheaderrequestall">
parseHTTPHeaderRequestAll
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
false
</td>
<td>
(Since 1.6) Parse ALL HTTP request headers not already parsed
using the [headers-http-request] section
</td>
</tr>
<tr>
<td id="parsehttpheaderresponseall">
parseHTTPHeaderResponseAll
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
false
</td>
<td>
(Since 1.6) Parse ALL HTTP request headers not already parsed
using the [headers-http-response] section
</td>
</tr>
<tr>
<td id="pcapdir">
pcapDir
<span class="fa fa-link small copy-link cursor-copy"
onclick="copyLink(this, 'settings')">
</span>
</td>
<td>
EMPTY
</td>
<td>
Semicolon separated list of directories to save pcap files to.