collect

NET.COLLECT

net.collect is the collection server for receiving audit records from several net.agent's exporting data.

Description

The collection server decrypts messages adressed to itself from the agents, and writes them to the file system.

Read more about this tool in the documentation: https://docs.netcap.io

Usage examples

Both collector and agent can be configured by using the -addr flag to specify an IP address and port. To generate a keypair for the server, the -gen-keypair flag must be used:

$ net.collect -gen-keypair 
wrote keys
$ ls
priv.key pub.key

Start the server:

$ net.collect -privkey priv.key -addr 127.0.0.1:4200 
packet-received: bytes=2412 from=127.0.0.1:57368 decoded batch NC_Ethernet from client xyz
new file xyz/Ethernet.ncap
packet-received: bytes=2701 from=127.0.0.1:65050 decoded batch NC_IPv4 from client xyz
new file xyz/IPv4.ncap
...

Help

$ net.collect -h
    -addr string
            specify an adress and port to listen for incoming traffic (default "127.0.0.1:1335")
    -allowmissinginit
            support streams without SYN/SYN+ACK/ACK sequence
    -assembly_debug_log
            If true, the github.com/google/gopacket/reassembly library will log verbose debugging information (at least one line per packet)
    -assembly_memuse_log
            If true, the github.com/google/gopacket/reassembly library will log information regarding its memory use every once in a while.
    -checksum
            check TCP checksum
    -conn-flush-interval int
            flush connections every X flows (default 10000)
    -conn-timeout int
            close connections older than X seconds (default 60)
    -debug
            display debug information
    -dump
            dump HTTP request/response as hex
    -files string
            path to create file for HTTP 200 OK responses
    -flow-flush-interval int
            flush flows every X flows (default 2000)
    -flow-timeout int
            close flows older than X seconds (default 30)
    -flushevery int
            flush assembler every N packets (default 10000)
    -gen-keypair
            generate keypair
    -ignorefsmerr
            ignore TCP FSM errors
    -memprofile string
            write memory profile
    -nodefrag
            if true, do not do IPv4 defrag
    -nohttp
            disable HTTP parsing
    -nooptcheck
            do not check TCP options (useful to ignore MSS on captures with TSO)
    -privkey string
            path to the hex encoded server private key
    -quiet
            be quiet regarding errors (default true)
    -tcp-close-timeout int
            close tcp streams if older than X seconds (set to 0 to keep long lived streams alive) (default 180)
    -tcp-timeout int
            close streams waiting for packets older than X seconds (default 120)
    -verbose
            be verbose
    -writeincomplete
            write incomplete response