Package encoder

netcap: github.com/dreadl0ck/netcap/encoder Index | Files

package encoder

import "github.com/dreadl0ck/netcap/encoder"

Implements encoders to transform network packets into protocol buffers for various protocols

var (
    // LayerEncoders map contains initialized encoders at runtime
    // for usage from other packages
    LayerEncoders = map[gopacket.LayerType][]*LayerEncoder{}

    // set via encoder config
    // used to request a content from being set on the audit records
    AddContext bool
)

❖

var (
    // LiveMode switch for all encoders
    LiveMode bool

    // CapturePayload for encoders that support it
    CapturePayload = false
)

❖

var (
    // Connections hold all connections
    Connections = &AtomicConnMap{
        Items: make(map[string]*types.Connection),
    }
)

❖

var (
    // CustomEncoders slice contains initialized encoders at runtime
    // for usage from other packages
    CustomEncoders = []*CustomEncoder{}
)

❖

var (
    Flows = &AtomicFlowMap{
        Items: make(map[string]*types.Flow),
    }
)

❖

var (

    // HTTPActive must be set to true to decode HTTP traffic
    HTTPActive bool
)

❖

var (
    LinkFlows = &AtomicLinkFlowMap{
        Items: make(map[uint64]*types.LinkFlow),
    }
)

❖

var (
    NetworkFlows = &AtomicNetworkFlowMap{
        Items: make(map[uint64]*types.NetworkFlow),
    }
)

❖

var (
    TransportFlows = &AtomicTransportFlowMap{
        Items: make(map[uint64]*types.TransportFlow),
    }
)

func DecodeHTTP ¶ Uses

❖

func DecodeHTTP(packet gopacket.Packet)

DecodeHTTP passes TCP packets to the TCP stream reassembler in order to decode HTTP request and responses CAUTION: this function must be called sequentially, because the stream reassembly implementation currently does not handle out of order packets

func DumpTop5LinkFlows ¶ Uses

❖

func DumpTop5LinkFlows()

func DumpTop5NetworkFlows ¶ Uses

❖

func DumpTop5NetworkFlows()

func DumpTop5TransportFlows ¶ Uses

❖

func DumpTop5TransportFlows()

func Entropy ¶ Uses

❖

func Entropy(data []byte) (entropy float64)

Entropy returns the shannon entropy value https://rosettacode.org/wiki/Entropy#Go

func ExtractTLSHandShake ¶ Uses

❖

func ExtractTLSHandShake(tcp *layers.TCP) (*tlsx.ClientHello, bool)

ExtractTLSHandShake extracts a TLS HandShake from a TCP Packet

func InitCustomEncoders ¶ Uses

❖

func InitCustomEncoders(c Config)

InitCustomEncoders initializes all custom encoders

func InitLayerEncoders ¶ Uses

❖

func InitLayerEncoders(c Config)

InitLayerEncoders initializes all layer encoders

func MarkdownOverview ¶ Uses

❖

func MarkdownOverview()

MarkdownOverview dumps a Markdown summary of all available encoders and their fields

func SetErrorMap ¶ Uses

❖

func SetErrorMap(m *AtomicCounterMap)

func ShowEncoders ¶ Uses

❖

func ShowEncoders()

type AtomicConnMap ¶ Uses

❖

type AtomicConnMap struct {
    Items map[string]*types.Connection
    sync.Mutex
}

AtomicConnMap contains all connections and provides synchronized access

func (*AtomicConnMap) Size ¶ Uses

❖

func (a *AtomicConnMap) Size() int

Size returns the number of elements in the Items map

type AtomicCounterMap ¶ Uses

❖

type AtomicCounterMap struct {
    Items map[string]int64
    sync.Mutex
}

AtomicCounterMap maps strings to integers

func NewAtomicCounterMap ¶ Uses

❖

func NewAtomicCounterMap() *AtomicCounterMap

NewAtomicCounterMap returns a new AtomicCounterMap

func (*AtomicCounterMap) Inc ¶ Uses

❖

func (a *AtomicCounterMap) Inc(val string)

Inc increments a value

type AtomicFlowMap ¶ Uses

❖

type AtomicFlowMap struct {
    Items map[string]*types.Flow
    sync.Mutex
}

func (*AtomicFlowMap) Size ¶ Uses

❖

func (a *AtomicFlowMap) Size() int

type AtomicLinkFlowMap ¶ Uses

❖

type AtomicLinkFlowMap struct {
    Items map[uint64]*types.LinkFlow
    sync.Mutex
}

type AtomicNetworkFlowMap ¶ Uses

❖

type AtomicNetworkFlowMap struct {
    Items map[uint64]*types.NetworkFlow
    sync.Mutex
}

type AtomicTransportFlowMap ¶ Uses

❖

type AtomicTransportFlowMap struct {
    Items map[uint64]*types.TransportFlow
    sync.Mutex
}

type Config ¶ Uses

❖

type Config struct {
    Buffer          bool
    Compression     bool
    CSV             bool
    IncludeEncoders string
    ExcludeEncoders string
    Out             string
    WriteChan       bool
    Source          string
    Version         string
    IncludePayloads bool
    Export          bool
    AddContext      bool
    MemBufferSize   int
}

Config contains configuration parameters for the encoders

type ConnectionID ¶ Uses

❖

type ConnectionID struct {
    LinkFlowID      uint64
    NetworkFlowID   uint64
    TransportFlowID uint64
}

ConnectionID is a bidirectional connection between two devices over the network that includes the Link, Network and TransportLayer

func (ConnectionID) String ¶ Uses

❖

func (c ConnectionID) String() string

type Context ¶ Uses

❖

type Context struct {
    CaptureInfo gopacket.CaptureInfo
}

Context is the assembler context

func (*Context) GetCaptureInfo ¶ Uses

❖

func (c *Context) GetCaptureInfo() gopacket.CaptureInfo

GetCaptureInfo returns the gopacket.CaptureInfo from the context

type CustomEncoder ¶ Uses

❖

type CustomEncoder struct {

    // public fields
    Name string

    Type    types.Type
    Handler CustomEncoderHandler
    // contains filtered or unexported fields
}

CustomEncoder implements custom logic to decode data from a gopacket.Packet

func CreateCustomEncoder ¶ Uses

❖

func CreateCustomEncoder(t types.Type, name string, postinit func(*CustomEncoder) error, handler CustomEncoderHandler, deinit func(*CustomEncoder) error) *CustomEncoder

CreateCustomEncoder returns a new CustomEncoder instance

func (*CustomEncoder) Destroy ¶ Uses

❖

func (e *CustomEncoder) Destroy() (name string, size int64)

Destroy closes and flushes all writers and calls deinit if set

func (*CustomEncoder) Encode ¶ Uses

❖

func (e *CustomEncoder) Encode(p gopacket.Packet) error

Encode is called for each layer this calls the handler function of the encoder and writes the serialized protobuf into the data pipe

func (*CustomEncoder) GetChan ¶ Uses

❖

func (e *CustomEncoder) GetChan() <-chan []byte

GetChan returns a channel to receive serialized protobuf data from the encoder

func (*CustomEncoder) NumRecords ¶ Uses

❖

func (e *CustomEncoder) NumRecords() int64

NumRecords returns the number of written records

type CustomEncoderHandler ¶ Uses

❖

type CustomEncoderHandler = func(p gopacket.Packet) proto.Message

CustomEncoderHandler takes a gopacket.Packet and returns a proto.Message

type LayerEncoder ¶ Uses

❖

type LayerEncoder struct {

    // public fields
    Layer gopacket.LayerType
    Type  types.Type

    Handler LayerEncoderHandler
    // contains filtered or unexported fields
}

LayerEncoder represents an encoder for the gopacket.Layer type

func CreateLayerEncoder ¶ Uses

❖

func CreateLayerEncoder(nt types.Type, lt gopacket.LayerType, handler LayerEncoderHandler) *LayerEncoder

CreateLayerEncoder returns a new LayerEncoder instance

func (*LayerEncoder) Destroy ¶ Uses

❖

func (e *LayerEncoder) Destroy() (name string, size int64)

Destroy closes and flushes all writers

func (*LayerEncoder) Encode ¶ Uses

❖

func (e *LayerEncoder) Encode(ctx *types.PacketContext, p gopacket.Packet, l gopacket.Layer) error