lilithsec / daemonlogger Goto Github PK
View Code? Open in Web Editor NEWThis project forked from cisco-talos/daemonlogger
Daemonlogger Fork
Home Page: https://talosintelligence.com/daemon
License: GNU General Public License v2.0
This project forked from cisco-talos/daemonlogger
Daemonlogger Fork
Home Page: https://talosintelligence.com/daemon
License: GNU General Public License v2.0
DaemonLogger: Simple packet logging & soft tap daemon. Version 1.2.1 Copyright (C) 2013-2021 Cisco Systems, Inc. Copyright (C) 2006-2013 Sourcefire Inc. Author: Martin Roesch <[email protected]> This is a libpcap-based program. It has two runtime modes: 1) It sniffs packets and spools them straight to the disk and can daemonize itself for background packet logging. By default the file rolls over when 1 GB of data is logged. 2) It sniffs packets and rewrites them to a second interface, essentially acting as a soft tap. It can also do this in daemon mode. These two runtime modes are mutually exclusive, if the program is placed in tap mode (using the -o switch) then logging to disk is disabled. License: GPL v2. Make SURE you read the included COPYING file so that you understand how this file is licensed by Cisco, even though it's under the GPL v2 there are some clarifications that we have made regarding the licensing of this program. Requirements: * A recent version of libpcap. * A recent version of libdnet. Usage: daemonlogger [switches] [bpf filter] Switches: -B <bytes> Set packet capture buffer size -c <count> Capture <count> packets and exit. -d Daemonize at startup. -f <bpf file> Load BPF filter from <bpf file>. -F Make disk output "packet-buffered". As each packet is saved, it will be written to the output file rather than being written only when the output buffer fills. -g <group name> Set group ID to <group name>. -h Print usage message. -i <interface> Sniff packets from <interface>. -l <path> Specify a <path> to write the pcap logfiles into. -m <count> Write <count> log files and exit. If using Ringbufer mode then write <count> files and delete the oldest file in the set when you exceed <count> log files written. The program will not exit when in this mode. -M <pct> Used in concert with the -r ringbuffer switch this option will write log files to the disk until it is at <pct> utilization and then roll over and delete the oldest log file. For example, "-M 90" would write files to the disk until it is 90% utilized and then roll over and delete the oldest file in the logging directory. If the -s "size" switch is not set then the default log file size is 2GB. -n <name> Set output filename prefix to <name>. Default is "daemonlogger.pcap". -o <outf> Disable packet logging and write packets received on <interface> on <outf>. Activates tap mode. Example: daemonlogger -i en0 -o gre0 -p <pidfile> Set an explicit <pidfile> filename. Default is daemonlogger.pid. -P <pidpath> Set an explicit <pidpath> directory. Default is /var/run. -r Activate ringbuffer mode. -s <size> Rollover the log file if it reaches <size> bytes. -S <snaplen> Set the number of bytes to grab per packet to <snaplen>. -t <time> Rollover the log file on time intervals. Append an 'm' to rollover on minute boundaries, 'h' to rollover on hour boundaries and 'd' to rollover on day boundaries. If no interval selector is used then the default rollover interval is in seconds. For example, "-t 60" rolls the log file over every 60 seconds and "-t 2h" rolls the log file over every two hours at the top of the hour. In the case of minute/hour/day-based rollovers, the will round to the next highest hour. For example, if the program is told to rollover every 2 hours and is started 38 minutes into the current hour it will add 2 to the current hour and rollover as scheduled at the top of the hour at <current hour> + 2. If the program was started at 13:38 it would roll over the logfile at 15:00. -T <chroot> Chroot directory to <chroot>. -u <user name> Set user ID to <user name>. -v Show daemonlogger version. -z Select log file pruning behavior. Omitting this switch results in the default mode being used where the oldest log file in the logging directory is pruned. Setting the -z switch changes the behavior so that Daemonlogger will prune the oldest file from its current instantiation and leave files from older runs in the same logging directory alone. BPF Filter: You can specify BPF filter commands after the command line switches just like in tcpdump or Snort. This code is largely untested and probably completely shoddy. YMMV. Write us on the Daemonlogger Users list: https://lists.sourceforge.net/lists/listinfo/daemonlogger-users if you have any questions!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.