netcap: github.com/dreadl0ck/netcap/encoder Index | Files

package encoder

import "github.com/dreadl0ck/netcap/encoder"

Implements encoders to transform network packets into protocol buffers for various protocols

Index

Package Files

arp.go bfd.go cip.go ciscoDicoveryInfo.go ciscoDiscovery.go config.go connection.go counters.go customEncoder.go dhcp4.go dhcp6.go dns.go dot11.go dot1q.go eap.go eapol.go eapolkey.go enip.go eth.go ethctp.go ethctpr.go fddi.go flow.go geneve.go gre.go http.go httpReader.go icmp4.go icmp6.go icmp6e.go icmp6na.go icmp6ns.go icmp6ra.go icmp6rs.go igmp.go init.go ip4.go ip6.go ip6hop.go ipsecah.go ipsecesp.go ipv6fragment.go layerEncoder.go lcm.go linkFlow.go llc.go lld.go lldi.go modbus.go mpls.go networkFlow.go nortelDiscovery.go ntp.go ospfv2.go ospfv3.go sctp.go shared.go sip.go snap.go tcp.go tcpStream.go tls.go transportFlow.go udp.go usb.go usbRequestBlockSetup.go utils.go vrrpv2.go vxlan.go

Variables

var (
    // LayerEncoders map contains initialized encoders at runtime
    // for usage from other packages
    LayerEncoders = map[gopacket.LayerType][]*LayerEncoder{}

    // set via encoder config
    // used to request a content from being set on the audit records
    AddContext bool
)
var (
    // LiveMode switch for all encoders
    LiveMode bool

    // CapturePayload for encoders that support it
    CapturePayload = false
)
var (
    // Connections hold all connections
    Connections = &AtomicConnMap{
        Items: make(map[string]*types.Connection),
    }
)
var (
    // CustomEncoders slice contains initialized encoders at runtime
    // for usage from other packages
    CustomEncoders = []*CustomEncoder{}
)
var (
    Flows = &AtomicFlowMap{
        Items: make(map[string]*types.Flow),
    }
)
var (

    // HTTPActive must be set to true to decode HTTP traffic
    HTTPActive bool
)
var (
    LinkFlows = &AtomicLinkFlowMap{
        Items: make(map[uint64]*types.LinkFlow),
    }
)
var (
    NetworkFlows = &AtomicNetworkFlowMap{
        Items: make(map[uint64]*types.NetworkFlow),
    }
)
var (
    TransportFlows = &AtomicTransportFlowMap{
        Items: make(map[uint64]*types.TransportFlow),
    }
)

func DecodeHTTP Uses

func DecodeHTTP(packet gopacket.Packet)

DecodeHTTP passes TCP packets to the TCP stream reassembler in order to decode HTTP request and responses CAUTION: this function must be called sequentially, because the stream reassembly implementation currently does not handle out of order packets

func DumpTop5LinkFlows Uses

func DumpTop5LinkFlows()

func DumpTop5NetworkFlows Uses

func DumpTop5NetworkFlows()

func DumpTop5TransportFlows Uses

func DumpTop5TransportFlows()

func Entropy Uses

func Entropy(data []byte) (entropy float64)

Entropy returns the shannon entropy value https://rosettacode.org/wiki/Entropy#Go

func ExtractTLSHandShake Uses

func ExtractTLSHandShake(tcp *layers.TCP) (*tlsx.ClientHello, bool)

ExtractTLSHandShake extracts a TLS HandShake from a TCP Packet

func InitCustomEncoders Uses

func InitCustomEncoders(c Config)

InitCustomEncoders initializes all custom encoders

func InitLayerEncoders Uses

func InitLayerEncoders(c Config)

InitLayerEncoders initializes all layer encoders

func MarkdownOverview Uses

func MarkdownOverview()

MarkdownOverview dumps a Markdown summary of all available encoders and their fields

func SetErrorMap Uses

func SetErrorMap(m *AtomicCounterMap)

func ShowEncoders Uses

func ShowEncoders()

type AtomicConnMap Uses

type AtomicConnMap struct {
    Items map[string]*types.Connection
    sync.Mutex
}

AtomicConnMap contains all connections and provides synchronized access

func (*AtomicConnMap) Size Uses

func (a *AtomicConnMap) Size() int

Size returns the number of elements in the Items map

type AtomicCounterMap Uses

type AtomicCounterMap struct {
    Items map[string]int64
    sync.Mutex
}

AtomicCounterMap maps strings to integers

func NewAtomicCounterMap Uses

func NewAtomicCounterMap() *AtomicCounterMap

NewAtomicCounterMap returns a new AtomicCounterMap

func (*AtomicCounterMap) Inc Uses

func (a *AtomicCounterMap) Inc(val string)

Inc increments a value

type AtomicFlowMap Uses

type AtomicFlowMap struct {
    Items map[string]*types.Flow
    sync.Mutex
}

func (*AtomicFlowMap) Size Uses

func (a *AtomicFlowMap) Size() int

type AtomicLinkFlowMap Uses

type AtomicLinkFlowMap struct {
    Items map[uint64]*types.LinkFlow
    sync.Mutex
}

type AtomicNetworkFlowMap Uses

type AtomicNetworkFlowMap struct {
    Items map[uint64]*types.NetworkFlow
    sync.Mutex
}

type AtomicTransportFlowMap Uses

type AtomicTransportFlowMap struct {
    Items map[uint64]*types.TransportFlow
    sync.Mutex
}

type Config Uses

type Config struct {
    Buffer          bool
    Compression     bool
    CSV             bool
    IncludeEncoders string
    ExcludeEncoders string
    Out             string
    WriteChan       bool
    Source          string
    Version         string
    IncludePayloads bool
    Export          bool
    AddContext      bool
    MemBufferSize   int
}

Config contains configuration parameters for the encoders

type ConnectionID Uses

type ConnectionID struct {
    LinkFlowID      uint64
    NetworkFlowID   uint64
    TransportFlowID uint64
}

ConnectionID is a bidirectional connection between two devices over the network that includes the Link, Network and TransportLayer

func (ConnectionID) String Uses

func (c ConnectionID) String() string

type Context Uses

type Context struct {
    CaptureInfo gopacket.CaptureInfo
}

Context is the assembler context

func (*Context) GetCaptureInfo Uses

func (c *Context) GetCaptureInfo() gopacket.CaptureInfo

GetCaptureInfo returns the gopacket.CaptureInfo from the context

type CustomEncoder Uses

type CustomEncoder struct {

    // public fields
    Name string

    Type    types.Type
    Handler CustomEncoderHandler
    // contains filtered or unexported fields
}

CustomEncoder implements custom logic to decode data from a gopacket.Packet

func CreateCustomEncoder Uses

func CreateCustomEncoder(t types.Type, name string, postinit func(*CustomEncoder) error, handler CustomEncoderHandler, deinit func(*CustomEncoder) error) *CustomEncoder

CreateCustomEncoder returns a new CustomEncoder instance

func (*CustomEncoder) Destroy Uses

func (e *CustomEncoder) Destroy() (name string, size int64)

Destroy closes and flushes all writers and calls deinit if set

func (*CustomEncoder) Encode Uses

func (e *CustomEncoder) Encode(p gopacket.Packet) error

Encode is called for each layer this calls the handler function of the encoder and writes the serialized protobuf into the data pipe

func (*CustomEncoder) GetChan Uses

func (e *CustomEncoder) GetChan() <-chan []byte

GetChan returns a channel to receive serialized protobuf data from the encoder

func (*CustomEncoder) NumRecords Uses

func (e *CustomEncoder) NumRecords() int64

NumRecords returns the number of written records

type CustomEncoderHandler Uses

type CustomEncoderHandler = func(p gopacket.Packet) proto.Message

CustomEncoderHandler takes a gopacket.Packet and returns a proto.Message

type LayerEncoder Uses

type LayerEncoder struct {

    // public fields
    Layer gopacket.LayerType
    Type  types.Type

    Handler LayerEncoderHandler
    // contains filtered or unexported fields
}

LayerEncoder represents an encoder for the gopacket.Layer type

func CreateLayerEncoder Uses

func CreateLayerEncoder(nt types.Type, lt gopacket.LayerType, handler LayerEncoderHandler) *LayerEncoder

CreateLayerEncoder returns a new LayerEncoder instance

func (*LayerEncoder) Destroy Uses

func (e *LayerEncoder) Destroy() (name string, size int64)

Destroy closes and flushes all writers

func (*LayerEncoder) Encode Uses

func (e *LayerEncoder) Encode(ctx *types.PacketContext, p gopacket.Packet, l gopacket.Layer) error

Encode is called for each layer this calls the handler function of the encoder and writes the serialized protobuf into the data pipe

func (*LayerEncoder) GetChan Uses

func (e *LayerEncoder) GetChan() <-chan []byte

GetChan returns a channel to receive serialized protobuf data from the encoder

type LayerEncoderHandler Uses

type LayerEncoderHandler = func(layer gopacket.Layer, timestamp string) proto.Message

LayerEncoderHandler is the handler function for a layer encoder

type Stream Uses

type Stream struct {
    // contains filtered or unexported fields
}

Stream contains both unidirectional flows for a connection

func (Stream) Reverse Uses

func (s Stream) Reverse() Stream

Reverse flips source and destination

func (Stream) String Uses

func (s Stream) String() string

Package encoder imports 35 packages (graph) and is imported by 11 packages. Updated 2020-03-16. Refresh now. Tools for package owners.