Rather than performing out-of-band bulk packet captures, configure the Manager to automatically capture relevant network traffic from each clone, in order to detect when a compromise occurs. This data should be in PCAP format and should be eventually provided to the Drone web service, referenced by the fingerprint generated.

Net::Packet::Dump looks promising, but currently has a hardcoded snaplen of 1514. I'm trying to contact the author to make this snaplen configurable (65535).

Here's a possible (untested) patch to Dump.pm (Net::Packet::Dump v3.25) {{{

!patch

--- Dump.pm 2006-11-23 17:52:16.000000000 -0500 +++ Dump.pm-new.pm 2008-03-24 16:57:11.137005061 -0400 @@ -35,6 +35,7 @@ noLayerWipe mode keepTimestamp

snaplen _pid _pcapd _dumper @@ -82,6 +83,7 @@ frames => [], mode => NP_DUMP_MODE_ONLINE, keepTimestamp => 0,
snaplen => 1514, _sDataAwaiting => 0, sName => "netpacket-tmp-$$.@{[getRandom32bitsInt()]}.storable", @, @@ -219,7 +221,7 @@ my $err; my $pd = Net::Pcap::open_live( $self->[$__dev],
1514,
$self->[$snaplen], $self->[$promisc], 1000, \$err, @@ -641,6 +643,7 @@ file => 'live.pcap', filter => 'tcp', promisc => 1,
```
snaplen       => 1514,
```
noStore => 1, keepTimestamp => 1, unlinkOnClean => 0, @@ -757,6 +760,10 @@

If you want to capture in promiscuous mode, set it to 1. Default to 0.

+=item B + +If you want to capture a different snaplen, set it a number. Default to 1514. + =item B

This attribute tells which datalink type is used for .pcap files. @@ -829,6 +836,8 @@

promisc: 0

+snaplen: 1514 + timeoutOnNext: 3

isRunning: 0 }}}

dkindlund / honeyclient

Add Support For Programmatic Network Packet Capture #151

!patch