Whats new in v0.3.9

Protocols

Many new protocols have been added since the initial release in December 2018, including: OSPF, GRE, IPSec, USB, Geneve, VXLAN, LCM, ModbusTCP, MPLS, BFD, EAP, VRRPv2, CiscoDiscovery and more.

Protobuf serialization performance

Since version 0.3.9 proto serialization is much faster, thanks to a different code generator that generates more efficient code for packing and unpacking the protocol buffers in golang.

with golang code generator:

$ go test -bench=. -v ./types
=== RUN   TestMarshal
--- PASS: TestMarshal (0.00s)
goos: darwin
goarch: amd64
pkg: github.com/dreadl0ck/netcap/types
BenchmarkMarshal-12         10000000           184 ns/op          64 B/op          1 allocs/op
BenchmarkUnmarshal-12       10000000           160 ns/op          40 B/op          2 allocs/op
PASS
ok      github.com/dreadl0ck/netcap/types   3.830s

with gogo code generator:

$ go test -bench=. -v ./types
=== RUN   TestMarshal
--- PASS: TestMarshal (0.00s)
goos: darwin
goarch: amd64
pkg: github.com/dreadl0ck/netcap/types
BenchmarkMarshal-12         20000000            89.1 ns/op        64 B/op          1 allocs/op
BenchmarkUnmarshal-12       20000000           110 ns/op          40 B/op          2 allocs/op
PASS
ok      github.com/dreadl0ck/netcap/types   4.215s

However, for this to work, the fields named Size on several audit records structures had to be renamed, because the new code generator generates a function named Size() on each protocol buffer.

The new field name is TotalSize.

Payload capture

It is now possible to capture payload data for the following protocols: TCP, UDP, ModbusTCP, USB

This can be enabled with the -payload flag:

net.capture -r traffic.pcap -payload

Also available for live capture:

net.capture -iface en0 -payload

USB decoding

USB live capture is now possible, currently the following Audit Records exist: USB and USBRequestBlockSetup.

To capture USB traffic live on macOS, install wireshark and bring up the USB interface:

sudo ifconfig XHC20 up

Now attach netcap and set baselayer to USB:

net.capture -iface XHC20 -base usb

To read offline USB traffic from a PCAP file use:

net.capture -r usb.pcap -base usb

Configurable separators for CSV structures

The separator characters for structs in CSV output mode are now configurable via commandline flags. Default is ‘(’ for opening, ‘-’ as separator for values and ‘)’ for closing.

type Message struct {
    Text              string 
    Secret           bool   
    MagicNumber int    
}

instantiated as

msg := &Message{
    Text:             "Hi",
    Secret:           true,
    MagicNumber: 42,
}

would appear in CSV like:

(Text-Secret-MagicNumber)

with the concrete field values:

(Hi-true-42)

Configurable gopacket.DecodeOptions

Gopackets DecodeOptions are now configurable via commandline, three options exist:

  • lazy (gopacket.Lazy)
  • default (gopacket.Default)
  • nocopy (gopacket.NoCopy)

By default, netcap uses the the lazy decoding option.