search

TurboTurtle / rig

A lightweight, flexible, easy to use system monitoring and event handling utility
GNU General Public License v2.0
10 stars 7 forks source link

[packet] Add new `packet` rig + documentation #46

Closed juanmasg closed 2 years ago

juanmasg commented 2 years ago

This rig is a packet sniffer. It will trigger whenever a network packet matching the provided attributes is seen on any of the system interfaces. --ifname can be specified to ignore packets seen on interfaces other than the one defined.

The rig doesn't put the interfaces in promiscuous mode. Therefore only traffic where the source or destination is the host itself, or traffic with a multicast or broadcast destination will be seen.

By default, all the provided attributes must match for the rig to trigger. If --any is specified, then matching only one of the provided attributes is enough.

--payload is provided for convenience to match application payload on cleartext protocols. For example, it can be used to match HTTP requests or status codes, or DNS requests. However doing payload matching on systems with a high network traffic load will be resource intensive.

lgtm-com[bot] commented 2 years ago

This pull request introduces 4 alerts when merging c3ee1573a589ee05e5db84296fde32f80c9377e7 into 9d1e1a15bdcc0a2d42bac24239f146adcf2c7f1e - view on LGTM.com

new alerts: