Moloch on Docker-compose version with some fix. I took Dockerfile from danielguerra

Start moloch

sudo docker-compose up -d 

After run you can see to container:

CONTAINER ID        IMAGE                         COMMAND                  CREATED             STATUS              PORTS                              NAMES
6b16fb0e6fc6        moloch_docker-moloch          "/data/startmoloch.sh"   21 minutes ago      Up 21 minutes       0.0.0.0:8005->8005/tcp             moloch
682602deee97        elasticsearch:5.2.2-alpine    "/docker-entrypoint.s"   21 minutes ago      Up 21 minutes       0.0.0.0:9200->9200/tcp, 9300/tcp   esmoloch

Open your browser and open http://:8005/

Login/Password

admin/moloch

Moloch use utils moloch-capture to read pcap to elasticsearch view. Compose mount directory /tmp/dump to /data/pcap directory with pcap. You should run capture and give 2 arguments: name of pcap and tag of dump (if you want filtering soma pcap files to one find "process")

I wrote some bash script, this one take pcap files with path and tag how second argv

sudo /bin/bash moloch-eat /data/pcap/c2_cpe2.pcap c2

Stop moloch

sudo docker-compose down

Delete moloch

sudo docker-compose stop
sudo docker-compose rm