How to install Trisul (the network metering and forensics engine)
How to install Web-Trisul (the Ruby on Rails web frontend to Trisul)
Advanced installation tips
There are two ways to install Trisul.
If you have installed other open source projects, installing Trisul should be easy. It uses the familiar “configure” tools. There are some issues to keep in mind.
Trisul expects the following libraries to be installed before it can be compiled.
| Library name | Description | Website | Notes |
|---|---|---|---|
| libpcap-devel | Packet capture library development | http://www.tcpdump.org/ | Using yum or apt-get is going to be easier. On Fedora (yum install libpcap-devel) On Ubuntu (sudo apt-get install libpcap-dev) |
| log4cpp | C++ logging framework | Log4cpp 1.0 Sourceforge download page | Get the 1.0 version. You may want to use ./configure –disable-shared to always use static linking. Otherwise you have to muck around with the shared library (use LD_LIBRARY_PATH to include the /usr/local/lib/log4cpp directory) |
| openssl-devel | OpenSSL header files and libraries | http://www.openssl.org/ | Use a package for your Linux distro (eg, yum install openssl-devel on Fedora or sudo apt-get install openssl-dev on Ubuntu/Debian) Note: On Hardy, try sudo apt-get install libssl-dev. Compile from source (use this if you cannot find a package, or you know your way around OpenSSL) |
Trisul's output is in the form of a SQLITE3 database. Although SQLITE3 is not required for compiling Trisul, it is required to view the data.
Install SQLITE3 via -
After installation, test SQLITE3 by typing sqlite3 –version
Trisul uses the familiar autoconf toolset. So this section is going to be a breeze !
trisul-xxxxx.tar.gz.tar xvfz trisul-xxxxx.tar.gz cd trisul-xxxxxYou are now ready to run Trisul. Read the section on How to run Trisul ?
This is the easiest and recommended way to install Trisul.
Currently we provide packages for Ubuntu Hardy and Fedora 7. The packages should work on later releases as well. Tr y it out and let us know. You can get these packages from our download page
It is easy to install and run trisul from packages.
rpm -Uvh trisul-x.y.z.rpmservice trisul startsudo dpkg -u trisul_x.y.z.debsudo /etc/init.d/trisul startNotes on running trisul
/usr/local/share/trisul/crdb.sql3 file to listen on other adapters.nobody.nobody after it drops root privileges. We recommend you run it as trisul.trisul or as another user.You can edit the /usr/local/etc/trisul/trisulConfig.xml file, Setuid item to achieve this.If you want to get rid of Trisul, just type:
rpm -e trisul or sudo dpkg –remove trisul or sudo dpkg –purge trisulWeb Trisul is the Ruby on Rails application which allows you to interact with Trisul via a web browser.
There are two steps to installing Web-Trisul:
You must install Ruby and the Rails framework. See your platform specific instructions. There are instructions for Ubuntu here
Once you have Ruby and Rails installed successfully. You need to install the following gem
gem install builder)gem install sqlite3-ruby)Once you have installed the Rails framework, you are almost there. The installation mainly consists of unzipping the application and setting some permissions.
The way the permissions are setup, the Web Trisul server must belong to the same Linux user group as that of the Trisul server. For example : If you ran Trisul as trisul.trisul, then the user running Web Trisul must belong to the trisul group.
For example, to add myusername to the group trisul
useradd -G trisul myusername
You need to do this is because the capture files and the metering database is only readable by members of the trisul group.
You will now be on the dashboard page which will give you a real time view of what is happening on your network.
You can explore the pages further on your own.