# Cannot catch http.log on internal network machines, but it can be found on external network machines **URL:** \ **Category:** Zeek\ **Tags:** development, cluster, kafka, logging\ **Created:** [August 16, 2023, 6:50am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117 "2023-08-16T06:50:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![lideliang](https://avatars.discourse-cdn.com/v4/letter/l/bbce88/32.png) [@lideliang](https://community.zeek.org/u/lideliang)\ **Post date:** [August 16, 2023, 6:50am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/1 "2023-08-16T06:50:11Z")
Hello, I would like to obtain the HTTP request header, request body, response header, and response body through Zeek. Therefore, I built vmware17pro, zeek3.0.1, and metronpro plugin kafka on an external laptop. Everything is progressing smoothly, including pushing data into Kafka. However, during the process of exporting ovf from vmware to my intranet machine, zeek will not generate http.log, but can generate conn. log, dns. log, and so on. Do you need any special configurations to make the internal network effective? I have also built a local zeek on the external network, but cannot capture http.log on the internal machine The link I referenced [https://mp.weixin.qq.com/s?\_\_biz=MzAwMDQwNTE5MA==&mid=2650246104&idx=1&sn=fcc7446358e44e2610eb074ecce42e3e&chksm=82ea5071b59dd9674451f067b92896805e6932cfac3d7ee8e51810f45f18f85838bd6af6e657&scene=126&sessionid=1654532076&key=acb1db43c4248adcb8aba20712f8f2b82f2861be05a9ca396ad1117a85231f97a17181f46aba51e464c4eae6cf5e7d7dbecb2dc8f3321abaeac6c6ec8774bf24c1294bb239f4f75bb5252d535e1b620b15406eb3c91b6d62b13b8c09795fbc92c9ccb164fa6259ebb53283cc531a83a52cbc8085745f07bf72cf536a9c421c35&ascene=15&uin=NTY2NTA4NjQ%3D&devicetype=Windows](https://mp.weixin.qq.com/s?__biz=MzAwMDQwNTE5MA==&mid=2650246104&idx=1&sn=fcc7446358e44e2610eb074ecce42e3e&chksm=82ea5071b59dd9674451f067b92896805e6932cfac3d7ee8e51810f45f18f85838bd6af6e657&scene=126&sessionid=1654532076&key=acb1db43c4248adcb8aba20712f8f2b82f2861be05a9ca396ad1117a85231f97a17181f46aba51e464c4eae6cf5e7d7dbecb2dc8f3321abaeac6c6ec8774bf24c1294bb239f4f75bb5252d535e1b620b15406eb3c91b6d62b13b8c09795fbc92c9ccb164fa6259ebb53283cc531a83a52cbc8085745f07bf72cf536a9c421c35&ascene=15&uin=NTY2NTA4NjQ%3D&devicetype=Windows) +Server+2016+x64&Version=63060012&lang=zh CN&Session\_ Us=gh\_ B902de9201a8&exportkey=A8RDeGV7z% 2FZHnMQmLHfHrn8% 3D&acctmode=0&pass\_ Ticket=ug9ebHcf9fKbS3urjDlVAKXSYK6y4cQY9T5Al4wODa4jVvP1ccrZYm4gcaJ12&wx\_ Header=0&fontgear=2 ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [August 17, 2023, 4:48pm UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/2 "2023-08-17T16:48:26Z")
Hey @lideliang, > [@lideliang](#): > > Therefore, I built vmware17pro, zeek3.0.1, Could you instead use Zeek 6.0.0 if you’re starting in a new environment. Zeek 3.0.1 was released in 2019. For the rest of your observations, is there a way for you could confirm with another network monitoring tool like `tcpdump` or `wireshark` that the traffic you’re expecting is received by the monitoring interface? Much HTTP communication is encrypted these days, so `http.log` may be empty. You could cross check the `ssl.log`. Hope this helps, Arne ---
**Author:** ![lideliang](https://avatars.discourse-cdn.com/v4/letter/l/bbce88/32.png) [@lideliang](https://community.zeek.org/u/lideliang)\ **Post date:** [August 18, 2023, 1:35am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/3 "2023-08-18T01:35:26Z")
Later on, I also used the latest zeek 6.0.0, which was unable to generate http.log. However, I found through conn.log that there was indeed related traffic. I installed Wireshark on the virtual machine and observed HTTP traffic. I installed the OVF to the internal network through vmware export, modified the network card to ensure that the virtual machine can connect to the host, and modified network.cfg and node.cfg ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [August 18, 2023, 9:31am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/4 "2023-08-18T09:31:24Z")
> However, I found through conn.log that there was indeed related traffic. I installed Wireshark on the virtual machine and observed HTTP traffic. Is it possible to capture a subset (preferably just one flow) of traffic as `.pcap` file using `tcpdump` or `wireshark`, the compare the result between `zeek -r` and `wireshark`. In case of unexpected differences we’d be happy if you could share the pcap to take a look. Thanks, Arne ---
**Author:** ![lideliang](https://avatars.discourse-cdn.com/v4/letter/l/bbce88/32.png) [@lideliang](https://community.zeek.org/u/lideliang)\ **Post date:** [August 24, 2023, 10:51am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/5 "2023-08-24T10:51:12Z")
Why can I monitor HTTP traffic using domain name access, but not HTTP traffic using IP access. I built a centros (with GUI) using a virtual machine, and accessing the website using the browser on the virtual machine did not generate an http.log by entering an IP address. However, accessing the website using a domain name generated an http.log. Why is this happening? How to restore the generation of http.log through IP access to websites. Will there be such a problem when mirroring traffic through a switch. For example, if I access a website through IP and the traffic flows into Zeek, will it not generate an HTTP. log? ---
**Author:** ![lideliang](https://avatars.discourse-cdn.com/v4/letter/l/bbce88/32.png) [@lideliang](https://community.zeek.org/u/lideliang)\ **Post date:** [August 25, 2023, 5:46am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/6 "2023-08-25T05:46:44Z")
I know why http.log cannot be monitored because it is defined in/usr/local/zeek/share/zeek/base/protocols/http/main.zeek Const ports={ 80/tcp, 81/tcp, 631/tcp, 1080/tcp, 3128/tcp, 8000/TCP, 8080/TCP, 8888/TCP, }; Redef Likely\_ Server\_ Ports+={ports}; Is this a way of writing that only monitors these few port numbers? If I want to monitor all ports, should I enumerate all ports? ---
**Author:** ![awelzel](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/awelzel/32/609_2.png) [@awelzel](https://community.zeek.org/u/awelzel)\ **Post date:** [August 28, 2023, 7:43am UTC](https://community.zeek.org/t/cannot-catch-http-log-on-internal-network-machines-but-it-can-be-found-on-external-network-machines/7117/7 "2023-08-28T07:43:31Z")
> [@lideliang](#): > > Is this a way of writing that only monitors these few port numbers? If I want to monitor all ports, should I enumerate all ports? For non-standard ports, Zeek uses Dynamic Protocol Detection (DPD). Basically, analyzers are enabled based on signatures. The [following is used for HTTP](https://github.com/zeek/zeek/blob/master/scripts/base/protocols/http/dpd.sig). If this doesn’t work reliable for you, please share a pcap capture of your traffic. Another thought: Given you setup involves virtual machines: Have you looked at the [ignore\_checksums](https://docs.zeek.org/en/master/scripts/base/init-bare.zeek.html#id-ignore_checksums) option? If the history field in your `conn.log` contains `c` or `C` the packets might have incorrect checksums. Zeek ignores these by default. Hope this helps, Arne