Hedgehog & Malcolm Communication is not happening

[rushikeshk155]

Hello Admin ,
I have setup the Malcolm & Hedgehog in the Virtual machine env using VirtualBox. I have configured Malcolm and Hedgehog OS as guided in the videos and in the documentation on GitHub.

Malcom is configured in the Capture Only mode.
I have settted up the ethernet interfaces correctly on both machines . Both IP addresses are pinging to rach other.
The Time Sych is also happening from Hedgehog to Malcolm.

On the Hedgehog , I am able to see PCAP file size on the dashboard. Also , I could able to share the certificate files from Malcolm using the 'ssl-clinet recivee' config mode in the Hedgehog . However I am not able to connect to Malcom by using 'arkime-capture' forward config in the Hedgehod. The connection is getting timed out .

The dashboard data is also not updating on Malcolm.
How can I check my Malcolm configuration is correct and log forwarding config in the Hedgehog system is correct ?

Thanks in advance.

Regards,
Rushikesh

[mmguero]

Hi, @rushikeshk155. A few things you should check:

• During Malcolm configuration, what did you select for Should Malcolm accept logs and metrics from a Hedgehog Linux sensor or other forwarder? If you answered yes there, the appropriate ports should be exposed in Malcolm to allow Hedgehog to communicate. You could look at the ports section of the nginx-proxy section to give us an idea of what you did.
• During Hedgehog configuration when configuring arkime-capture you provided host, port, username, and password. Did you get an OpenSearch Connection succeeded1 message from that?
  • Are you using HTTP basic authentication for your authentication method, or something else? If so, the username/password you use for Hedgehog to talk to Malcolm's opensearch instance should be one configured at https://192.168.0.133/auth (or https://localhost/auth if you are on the Malcolm instance itself).

Check those things first, I expect one of them will fix your issue.

[rushikeshk155]

Hello @mmguero,
As per first communication , I had added two lines into 'docker-compose' file.(ports : 9200) . Then I was not able to load the Malcolm Homepage. I tried reconfiguring the Malcolm and Hedgehog with different configs. It didn't work.
Then I reinstalled both VMs Malcolm and Hegehog Linux. I followed the steps carefully and now Hedgehog Linux is communicating with Malcolm . I can see the Zeek Logs on the Malcolm dashboard. I think , I have made mistake while installing the Malcolm ( I didn't set the IP Address manually while installing the Malcolm VM and it was set to default IP 127.0.0.1).

Now I am facing one more issue.
I can see my OT netwotk traffic on Wireshark. But it's not forwading the traffic to the Hedgehog Linux.

My current config : There is a NAT Network configured on the VM and have used the same for both VMs (Hedgehog and Malcolm). On the Hedgehog , used two interfaces as suggetsted in the video. The second interface is for Promiscous purpose.

I am nit sure that how can I forward host machine traffic on to the Hedgehog interface ? I have tried with port forwarding options on the VM with port no 5044 . But it didn't work.

Really appericate your support and quick response.

Thanks in advance.
Rushikesh

[mmguero]

I'm glad you got the communication happening. I'm afraid I don't know enough about virtualbox networking to help you with traffic forwarding in that tool, though. You may have to resort to some google searching and look online.

[rushikeshk155]

Hello @mmguero ,
I have configured both Ethernet adapters on Hedgehog with Bridged Mode . Also , I did same network config for Malcolm VM. Malcolm and Hedgehog are communicating with each other. And I am getting the Network Traffic on the promiscuous port.

In the video , you have mentioned to configure ports with NAT Network. May I know what is the benefit of configuring in the NAT mode over Bridge mode ?

Thanks,
Rushikesh

[mmguero]

Sometimes NAT just tends to be easier to get set up which is why that's what I used for the video, but it just depends on the user and their situation. If you've got it working with bridged mode, then that's great, there's no real benefit of one or the other. Glad you got it working!