goprobe/frontend

Introduction

Today, targeted analyses of network traffic patterns have become increasingly difficult due to the sheer amount of traffic encountered. To enable them, traffic needs to be captured and examined and broken down to key descriptors which yield a condensed explanation of the underlying data.

The NetFlow standard was introduced to address this reduction. It uses the concept of flows, which com***e packets based on a set of shared packet attributes. NetFlow information is usually captured on one device and collected in a central database on another device. Several software probes are available, implementing NetFlow exporters and collectors.

goProbe deviates from traditional NetFlow as flow capturing and collection is run on the same device and the flow fields reduced. It was designed as a lightweight, standalone system, providing both optimized low-footprint packet capture and a storage backend tailored to the flow data in order to provide lightning-fast analysis queries.

Scope of this image

This Docker image provides the frontend component (i.e. the goProbe web UI), offering an intuitive web-based interface for the goProbe system. The frontend allows you to visualize and explore flow data captured by goProbe sensors and retrieved via the query service. In essence, it connects to an instance of the goProbe query component (global-query API) to run queries and display results in a user-friendly format.

Usage (Docker)

In order to spin up a running instance of the goProbe UI, simply run the frontend image. Ensure that you have a running sensor (or multiple sensors) collecting data and a query service aggregating those sensor instances. The frontend should be configured to communicate with the query service’s API. For example, if your query API is accessible at http://127.0.0.1:8146, you can run the frontend container as follows:

docker run --rm --name goprobe_frontend -p 8080:80 \
           -e QUERY_API_URL=http://127.0.0.1:8146 \
           goprobe/frontend:latest

This will start the frontend UI and map it to port 8080 on your host. In the above example, an environment variable is used to point the UI to the address of the global query service. Adjust the QUERY_API_URL to match your deployment (or refer to the documentation if a different configuration method is provided). Once running, you can access the goProbe web interface via your browser at http://localhost:8080 (if using the above port mapping). Through this interface, you can construct queries (e.g., selecting source IP, destination IP, ports, protocols, and time ranges) and view the resulting flow records. The frontend relies on the query service for data; queries you submit via the UI are forwarded to the configured query endpoint, and results are returned in real-time for analysis.

Usage (Compose)

A full docker-compose.yaml (including build parameters) can be found in the https://github.com/els0r/goProbe. A minimal example could look like this:

yaml
services:
  frontend:
    image: goprobe/frontend:latest
    restart: unless-stopped
    container_name: goprobe_frontent
    environment:
      - QUERY_API_URL=http://global_query:8146
    ports:
      - 8080:80