The commandline tools have been restructured and the framework now consists of:
- net.capture (capture audit records live or from dumpfiles)
- net.dump (dump with audit records in various formats)
- net.label (tool for creating labeled CSV datasets from netcap data)
- net.collect (collection server for distributed collection)
- net.agent (sensor agent for distributed collection)
- net.proxy (http reverse proxy for capturing traffic from web services)
- net.util (utility tool for validating audit records and converting timestamps)
- net.export (exporter for prometheus metrics)
The net.proxy tool allows to quickly spin up monitoring of web applications and retrieving netcap audit records. Since currently, TCP stream reassembly is only supported for IPv4, netcap misses HTTP traffic over IPv6 when decoding traffic from raw packets.
By using a simple reverse proxy for HTTP traffic, the operating system handles the stream reassembly and we can make sure no IPv6 traffic is missed.
Netcap now support exporting prometheus metrics about its go runtime, the collection process and the audit records itself. This feature can be used with the net.export tool.
Metrics are served by default on 127.0.0.1:7777/metrics.
Now we can configure a prometheus instance to scrape it and visualize the metrics in Grafana.
Checkout the docs for some previews of the Dashboard: https://docs.netcap.io/metrics
The netcap library now exposes a data structure for writing audit records to disk.
Checkout the GoDocs: https://godoc.org/github.com/dreadl0ck/netcap
type Writer func NewWriter(name string, buffer, compress, csv bool, out string, writeChan bool) *Writer func (w *Writer) Close() (name string, size int64) func (w *Writer) GetChan() <-chan byte func (w *Writer) Write(msg proto.Message) error func (w *Writer) WriteCSV(msg proto.Message) (int, error) func (w *Writer) WriteCSVHeader(msg proto.Message) (int, error) func (w *Writer) WriteHeader(t types.Type, source string, version string, includesPayloads bool) error func (w *Writer) WriteProto(msg proto.Message) error