README

Ennetix::Websocket
=================================
This zeek plugin uses Simple-websocket-server: https://gitlab.com/eidheim/Simple-WebSocket-Server library to send the logs. 

### Install using zkg
In the zeek-Websocket directory, run:
```
$ zkg install .
```

### Steps to install Simple-Websocket-Server:

```
$ sudo apt-get install libboost-all-dev
$ git clone https://gitlab.com/eidheim/Simple-WebSocket-Server.git
$ cd Simple-WebSocket-Server && mkdir build && cd build/ && cmake .. && make && make install
```

### Steps to manually configuring and installing
```
$ ./configure --with-websocket=/usr/local
```
Replace path with the Simple-websocket-library path.

```
$ cd build/ && cmake .. && make && make install
$ zeek -N
```
With the last command, you can see that the plugin included in the list.

Make sure that in /usr/local/incude the folder named simple-websocket-server is present.


Also shift the demo_client.cpp to simple-websocket-server folder and run the client
```
$ g++ demo_client.cpp -o demo_client -L/usr/lib -lssl -lcrypto 
$ ./demo_client
```

### Running the sample code using live traffic

```
$ zeek -i <interface> send_logs.zeek
```

### Running the sample code using pcap file
Then collect the packets using tcpdump. 
```
$ sudo tcpdump -s 0 -w get.trace
$ Zeek -C -r get.trace send_logs.zeek
```