Add PCAP-over-ip and BPF Support to assembler #24
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Thanks for open-sourcing this project. We have used Tulip during a CTF with a few patches of our own that we'd now like to contribute back into the original project.
This pull requests adds (semi-realtime) streaming PCAP support to Tulip by utilizing PCAP-over-ip, as well as BPF support for both file-based and PCAP-over-ip based traffic ingestion.
We wanted lower-latency traffic streaming and opted for PCAP-over-ip. As Tulip did not yet support this, we added PCAP-over-ip support. While we opted to combine this with pcap-broker to stream traffic from remote hosts, any pcap-over-ip server is supported.
This pull requests also adds support for adding a BPF filter, as we captured traffic once and distributed it to multiple listeners, for each of which we'd set the appropriate BPF. While we needed the BPF filter for PCAP-over-ip only, we also added it to the pcap file processing logic.