UnicodeDecodeError: 'utf-8' codec can't decode byte 0xbf in position 2: invalid start byte about analyzer-d4-passivedns HOT 4 CLOSED

Hi, interesting.
It looks like you are not feeding utf-8 do the analyzer, I have a bunch of questions:

• Can you tell me more about how you launch the passivedns client / on which system etc.?
• Is it failing systematically?
• Can you have a look in the D4-server web app and check the content of the redis queue?

from analyzer-d4-passivedns.

• Can you tell me more about how you launch the passivedns client / on which system etc.?
  I run on DNS server to stream DNS query to D4 server IP_D4_Server:
  sudo tcpdump -w - | /home/sysadmin/go/bin/d4-goclient -c /home/sysadmin/d4-goclient/conf.sample/ | socat - OPENSSL-CONNECT:IP_D4_Server:4443,verify=0
• Is it failing systematically?
  System run ok, but I can't see result of analytic .
• Can you have a look in the D4-server web app and check the content of the redis queue? Yes, i can see queue number change every time.

from analyzer-d4-passivedns.

Alright I think I see the issue :)

Tcpdump should be sent using type 1 and then consumed using analyzer-d4-pibs (the only analyzer we have for type 1 ATM).

If you want to analyze dns, you should pipe DNS captures with gamelinux's passivedns:

sudo passivedns -i eth0 -l /dev/stdout | ./d4-amd64l -c conf.sample

^^ in the present example I leave the go client handling the TLS connection to the D4 server.

Small tip regarding the analyzer's redis queue: you can see the last elements in the queue when you click on the increasing number of elements.

You can check this tutorial as it describes exactly what you are doing now.

from analyzer-d4-passivedns.

Ok, thank you so much! Well done!

from analyzer-d4-passivedns.