Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wireshark no longer publishes raw manuf (OUI) list #230

Closed
mmguero opened this issue Jul 28, 2023 · 3 comments
Closed

wireshark no longer publishes raw manuf (OUI) list #230

mmguero opened this issue Jul 28, 2023 · 3 comments
Assignees
@mmguero
Labels
arkime Relating to Malcolm's use of Arkime bug Something isn't working build For issues related to compilation/building external Depends on a bug or feature external to this project regression It worked at one point...
Milestone
v23.12.1

Comments

@mmguero
Copy link
Collaborator

mmguero commented Jul 28, 2023 •
edited
Loading

There are a few places in the Malcolm build code that were downloading the contents of the manuf file from WireShark's git repository. However, as of this commit that file no longer exists.

I've changed the code to use the previous release-4.0 branch, but this isn't a permanent solution. We need to figure out a more permanent way to get the latest version of this list.

sensor-iso/build.sh
164:  curl -s -S -L -o oui.txt "https://gitlab.com/wireshark/wireshark/raw/release-4.0/manuf"

shared/bin/manuf-oui-parse.py
20:DEFAULT_MANUF_URL = "https://gitlab.com/wireshark/wireshark/raw/release-4.0/manuf"

arkime/scripts/arkime_update_geo.sh
11:wget -nv -O oui.txt_new https://gitlab.com/wireshark/wireshark/raw/release-4.0/manuf && \

Dockerfiles/arkime.Dockerfile
209:  curl -s -S -L -o $ARKIME_DIR/etc/oui.txt "https://gitlab.com/wireshark/wireshark/raw/release-4.0/manuf"
@mmguero mmguero added bug Something isn't working arkime Relating to Malcolm's use of Arkime build For issues related to compilation/building external Depends on a bug or feature external to this project regression It worked at one point... labels Jul 28, 2023
@mmguero mmguero added this to Malcolm Jul 28, 2023
@mmguero
Copy link
Collaborator Author

mmguero commented Jul 28, 2023

See also arkime/arkime#2347

@mmguero
Copy link
Collaborator Author

mmguero commented Aug 1, 2023

See WireShark's make-manuf.py, it might be best for us to just do something similar and roll our own directly from IEEE.org.

This was referenced Aug 9, 2023
Closed
Merged
Merged
mmguero added a commit that referenced this issue Aug 15, 2023
@mmguero
Merge pull request #238 from idaholab/v23.08.0_merge_idaholab
a5678f7 
Malcolm v23.08.0 is a minor release with a few improvements, bug fixes and component updates.

v23.07.1...v23.08.0

* Features and enhancements
    + Rewrote the [Network Traffic Artifact Upload](https://idaholab.github.io/Malcolm/docs/upload.html#Upload) interface and backend, replacing the defunct [jQuery-File-Upload](https://github.com/blueimp/jQuery-File-Upload) with [FilePond](https://pqina.nl/filepond/). This was mainly due to jQuery-File-Upload no longer receiving security fixes and having some known vulnerabilities. see #235
    + Use [netbox-initializers](https://github.com/tobiasge/netbox-initializers) plugin, adding the ability to drop YAML files for various NetBox obects to be [preloaded](https://idaholab.github.io/Malcolm/docs/asset-interaction-analysis.html#NetBoxPreload) at startup. see #228
    + handle changes to ICSNPP parsers with source_ip/destination_ip fields (#233 and #226)

* Bug fixes
    + Fixed extracting Malcolm version during ISO build
    + Workaround for wireshark no longer publishing raw manuf (OUI) list (#230)
    + Remove news feed from default NetBox dashboard (as it would try to reach out to the web for RSS updates)

* Component version updates
    + Rebased Docker and ISO images to Debian 12 (bookworm)
    + live-build tool for building ISO images to debian/1%20230131
    + Arkime to [v4.4.0](https://github.com/arkime/arkime/blob/6f667600596e8a2252555640933f424730c258d5/CHANGELOG#L33-L55)
    + supercronic to [v0.2.26](https://github.com/aptible/supercronic/releases/tag/v0.2.26)
    + FileBeat to [v8.9.0](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.9.0.html)
    + LogStash to [v8.9.0](https://www.elastic.co/guide/en/logstash/8.9/logstash-8-9-0.html) (#234)
    + NetBox to [v3.5.7](https://github.com/netbox-community/netbox/releases/tag/v3.5.7)
    + PostgreSQL (used by NetBox) to [v15](https://www.postgresql.org/docs/release/15.0/)
    + opensearch-py to [v2.3.0](https://github.com/opensearch-project/opensearch-py/releases/tag/v2.3.0)
    + PHP (as used by Upload interface) to [v8.2](https://www.php.net/ChangeLog-8.php#PHP_8_2)
    + Fluent Bit to [v2.1.8](https://github.com/fluent/fluent-bit/releases/tag/v2.1.8)
    + certifi to [v2023.7.22](https://github.com/certifi/python-certifi/releases/tag/2023.07.22) (#229)
mmguero added a commit to cisagov/Malcolm that referenced this issue Aug 15, 2023
@mmguero
Merge pull request #274 from cisagov/v23.08.0_merge_cisagov
d5ee03e 
Malcolm v23.08.0 is a minor release with a few improvements, bug fixes and component updates.

v23.07.1...v23.08.0

* Features and enhancements
    + Rewrote the [Network Traffic Artifact Upload](https://cisagov.github.io/Malcolm/docs/upload.html#Upload) interface and backend, replacing the defunct [jQuery-File-Upload](https://github.com/blueimp/jQuery-File-Upload) with [FilePond](https://pqina.nl/filepond/). This was mainly due to jQuery-File-Upload no longer receiving security fixes and having some known vulnerabilities. see idaholab#235
    + Use [netbox-initializers](https://github.com/tobiasge/netbox-initializers) plugin, adding the ability to drop YAML files for various NetBox obects to be [preloaded](https://cisagov.github.io/Malcolm/docs/asset-interaction-analysis.html#NetBoxPreload) at startup. see idaholab#228
    + handle changes to ICSNPP parsers with source_ip/destination_ip fields (idaholab#233 and idaholab#226)

* Bug fixes
    + Fixed extracting Malcolm version during ISO build
    + Workaround for wireshark no longer publishing raw manuf (OUI) list (idaholab#230)
    + Remove news feed from default NetBox dashboard (as it would try to reach out to the web for RSS updates)

* Component version updates
    + Rebased Docker and ISO images to Debian 12 (bookworm)
    + live-build tool for building ISO images to debian/1%20230131
    + Arkime to [v4.4.0](https://github.com/arkime/arkime/blob/6f667600596e8a2252555640933f424730c258d5/CHANGELOG#L33-L55)
    + supercronic to [v0.2.26](https://github.com/aptible/supercronic/releases/tag/v0.2.26)
    + FileBeat to [v8.9.0](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.9.0.html)
    + LogStash to [v8.9.0](https://www.elastic.co/guide/en/logstash/8.9/logstash-8-9-0.html) (idaholab#234)
    + NetBox to [v3.5.7](https://github.com/netbox-community/netbox/releases/tag/v3.5.7)
    + PostgreSQL (used by NetBox) to [v15](https://www.postgresql.org/docs/release/15.0/)
    + opensearch-py to [v2.3.0](https://github.com/opensearch-project/opensearch-py/releases/tag/v2.3.0)
    + PHP (as used by Upload interface) to [v8.2](https://www.php.net/ChangeLog-8.php#PHP_8_2)
    + Fluent Bit to [v2.1.8](https://github.com/fluent/fluent-bit/releases/tag/v2.1.8)
    + certifi to [v2023.7.22](https://github.com/certifi/python-certifi/releases/tag/2023.07.22) (idaholab#229)
@mmguero mmguero moved this to Todo (develop) in Malcolm Aug 15, 2023
@mmguero mmguero moved this from Todo (develop) to Done in Malcolm Dec 5, 2023
@mmguero mmguero added this to the v23.12.1 milestone Dec 5, 2023
@mmguero
Copy link
Collaborator Author

mmguero commented Dec 5, 2023

resolved with #306

@mmguero mmguero closed this as completed Dec 5, 2023
@mmguero mmguero mentioned this issue Dec 5, 2023
Closed
@mmguero mmguero self-assigned this Dec 5, 2023
This was referenced Dec 20, 2023
Merged
Merged
@mmguero mmguero moved this from Done to Released in Malcolm Dec 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mmguero mmguero

Labels
arkime Relating to Malcolm's use of Arkime bug Something isn't working build For issues related to compilation/building external Depends on a bug or feature external to this project regression It worked at one point...
Projects
Malcolm
Status: Released
Milestone
v23.12.1
Development

No branches or pull requests
1 participant
@mmguero