Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add PCAP-over-ip and BPF Support to assembler #24

Conversation

MaxGroot
Copy link
Contributor

Thanks for open-sourcing this project. We have used Tulip during a CTF with a few patches of our own that we'd now like to contribute back into the original project.

This pull requests adds (semi-realtime) streaming PCAP support to Tulip by utilizing PCAP-over-ip, as well as BPF support for both file-based and PCAP-over-ip based traffic ingestion.

We wanted lower-latency traffic streaming and opted for PCAP-over-ip. As Tulip did not yet support this, we added PCAP-over-ip support. While we opted to combine this with pcap-broker to stream traffic from remote hosts, any pcap-over-ip server is supported.

This pull requests also adds support for adding a BPF filter, as we captured traffic once and distributed it to multiple listeners, for each of which we'd set the appropriate BPF. While we needed the BPF filter for PCAP-over-ip only, we also added it to the pcap file processing logic.

Copy link
Member

@Sijisu Sijisu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for contributing to Tulip!

Here are couple of small cosmetic changes I'd like, other than that LGTM!

services/go-importer/cmd/assembler/main.go Outdated Show resolved Hide resolved
services/go-importer/cmd/assembler/main.go Outdated Show resolved Hide resolved
Co-authored-by: Sijisu <mail@sijisu.eu>
services/go-importer/cmd/assembler/main.go Outdated Show resolved Hide resolved
services/go-importer/cmd/assembler/main.go Outdated Show resolved Hide resolved
services/go-importer/cmd/assembler/main.go Outdated Show resolved Hide resolved
Co-authored-by: Kristinn Vikar Jónsson <93918469+KristinnVikar@users.noreply.github.com>
@Sijisu
Copy link
Member

Sijisu commented Jul 26, 2023

Thanks @KristinnVikar for valuable fixes!

@Sijisu Sijisu merged commit c4ec0ff into OpenAttackDefenseTools:master Jul 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants