{"action":"created","issue":{"url":"https://api.github.com/repos/ntop/nProbe/issues/310","repository_url":"https://api.github.com/repos/ntop/nProbe","labels_url":"https://api.github.com/repos/ntop/nProbe/issues/310/labels{/name}","comments_url":"https://api.github.com/repos/ntop/nProbe/issues/310/comments","events_url":"https://api.github.com/repos/ntop/nProbe/issues/310/events","html_url":"https://github.com/ntop/nProbe/issues/310","id":379103754,"node_id":"MDU6SXNzdWUzNzkxMDM3NTQ=","number":310,"title":"--banned-hosts option in cento-ids is not working","user":{"login":"millefalcon","id":16983964,"node_id":"MDQ6VXNlcjE2OTgzOTY0","avatar_url":"https://avatars3.githubusercontent.com/u/16983964?v=4","gravatar_id":"","url":"https://api.github.com/users/millefalcon","html_url":"https://github.com/millefalcon","followers_url":"https://api.github.com/users/millefalcon/followers","following_url":"https://api.github.com/users/millefalcon/following{/other_user}","gists_url":"https://api.github.com/users/millefalcon/gists{/gist_id}","starred_url":"https://api.github.com/users/millefalcon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/millefalcon/subscriptions","organizations_url":"https://api.github.com/users/millefalcon/orgs","repos_url":"https://api.github.com/users/millefalcon/repos","events_url":"https://api.github.com/users/millefalcon/events{/privacy}","received_events_url":"https://api.github.com/users/millefalcon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"cardigliano","id":7548711,"node_id":"MDQ6VXNlcjc1NDg3MTE=","avatar_url":"https://avatars2.githubusercontent.com/u/7548711?v=4","gravatar_id":"","url":"https://api.github.com/users/cardigliano","html_url":"https://github.com/cardigliano","followers_url":"https://api.github.com/users/cardigliano/followers","following_url":"https://api.github.com/users/cardigliano/following{/other_user}","gists_url":"https://api.github.com/users/cardigliano/gists{/gist_id}","starred_url":"https://api.github.com/users/cardigliano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cardigliano/subscriptions","organizations_url":"https://api.github.com/users/cardigliano/orgs","repos_url":"https://api.github.com/users/cardigliano/repos","events_url":"https://api.github.com/users/cardigliano/events{/privacy}","received_events_url":"https://api.github.com/users/cardigliano/received_events","type":"User","site_admin":false},"assignees":[{"login":"cardigliano","id":7548711,"node_id":"MDQ6VXNlcjc1NDg3MTE=","avatar_url":"https://avatars2.githubusercontent.com/u/7548711?v=4","gravatar_id":"","url":"https://api.github.com/users/cardigliano","html_url":"https://github.com/cardigliano","followers_url":"https://api.github.com/users/cardigliano/followers","following_url":"https://api.github.com/users/cardigliano/following{/other_user}","gists_url":"https://api.github.com/users/cardigliano/gists{/gist_id}","starred_url":"https://api.github.com/users/cardigliano/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cardigliano/subscriptions","organizations_url":"https://api.github.com/users/cardigliano/orgs","repos_url":"https://api.github.com/users/cardigliano/repos","events_url":"https://api.github.com/users/cardigliano/events{/privacy}","received_events_url":"https://api.github.com/users/cardigliano/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-11-09T10:22:25Z","updated_at":"2018-11-12T14:08:37Z","closed_at":null,"author_association":"NONE","body":"Hello, the following are the steps i have used.\r\n\r\n[root@ip-172-31-6-162 cirries]# **cat /root/eggress.conf \r\n[egress.aggregated]\r\ndefault = shunt\r\nbanned-hosts = discard**\r\n\r\n[root@ip-172-31-6-162 cirries]# **cat banned.txt \r\ngoogle.com\r\nfacebook.com**\r\n\r\nSteps to reproduce:\r\n--------------------------\r\n1. /usr/local/bin/cento-ids -ieth0 -D 1 -z -B banned.txt -Feth1 --egress-conf eggress.conf\r\n2. /usr/local/bin/cento-ids -i eth1 --egress-conf eggress.conf -z -o 1 -C 11\r\n3. /usr/local/bin/cento-ids -i zc:11@0 --dump-path /tmp/\r\n4. ping -c 5 -n google.com && ping -c -n 5 facebook.com && ping -c 5 -n twitter.com # note the IPs\r\n5. Stop all the cento-ids process\r\n6. Check the /tmp/zc@11/[<d1>:<d2>:<ml>:]/<epoch-seconds>.txt for the IPs that you used to ping.\r\n\r\nObservation\r\n----------------\r\nThe IP for google.com and facebook.com are still present in the dump file.\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ntop/nProbe/issues/comments/437894040","html_url":"https://github.com/ntop/nProbe/issues/310#issuecomment-437894040","issue_url":"https://api.github.com/repos/ntop/nProbe/issues/310","id":437894040,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNzg5NDA0MA==","user":{"login":"millefalcon","id":16983964,"node_id":"MDQ6VXNlcjE2OTgzOTY0","avatar_url":"https://avatars3.githubusercontent.com/u/16983964?v=4","gravatar_id":"","url":"https://api.github.com/users/millefalcon","html_url":"https://github.com/millefalcon","followers_url":"https://api.github.com/users/millefalcon/followers","following_url":"https://api.github.com/users/millefalcon/following{/other_user}","gists_url":"https://api.github.com/users/millefalcon/gists{/gist_id}","starred_url":"https://api.github.com/users/millefalcon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/millefalcon/subscriptions","organizations_url":"https://api.github.com/users/millefalcon/orgs","repos_url":"https://api.github.com/users/millefalcon/repos","events_url":"https://api.github.com/users/millefalcon/events{/privacy}","received_events_url":"https://api.github.com/users/millefalcon/received_events","type":"User","site_admin":false},"created_at":"2018-11-12T14:08:37Z","updated_at":"2018-11-12T14:08:37Z","author_association":"NONE","body":"I'll take a dump after 3 minutes and see.\n\nOn Mon, Nov 12, 2018, 19:14 Alfredo Cardigliano <notifications@github.com>\nwrote:\n\n> You should not see packets for blacklisted flows is you specify\n> \"banned-hosts = discard\" in the egress configuration. However please note\n> that you can still see the first packets of the flow until the host is\n> identified.\n>\n> —\n> You are receiving this because you were mentioned.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/ntop/nProbe/issues/310#issuecomment-437885624>, or mute\n> the thread\n> <https://github.com/notifications/unsubscribe-auth/AQMnnK18xGJbBAKK6ns8jbnPsBfaZg8Hks5uuXtJgaJpZM4YWUaV>\n> .\n>\n"}}
{"actor":{"display_login":"millefalcon"}}