baladiwei
/
sniffer
mirror of https://mirror.trustie.net/root/sniffer.git
0
0
Fork 0
Code Issues Releases Wiki Activity
7 Commits 1 Branch 3 Tags 737 KiB
Go 100%
Go to file
chenjiandongx 3dc4b5e338 Update: perfect docs 2021-11-15 01:18:00 +08:00
.gitignore Update gitignore 2021-11-09 01:02:31 +08:00
LICENSE Init project 2021-11-08 23:34:49 +08:00
README.md Update: perfect docs 2021-11-15 01:18:00 +08:00
bytes-mode.jpg Update: perfect docs 2021-11-15 01:18:00 +08:00
cli.go Update: perfect docs 2021-11-15 01:18:00 +08:00
conn_darwin.go Update: add cli entrance for sniffer 2021-11-14 21:17:43 +08:00
conn_linux.go Add process render mode to show process netflow with plot 2021-11-10 22:11:24 +08:00
conn_windows.go Add process render mode to show process netflow with plot 2021-11-10 22:11:24 +08:00
dns.go Add Sniffer Options and use the lookup func in the pcap client 2021-11-09 00:29:48 +08:00
go.mod Update: add cli entrance for sniffer 2021-11-14 21:17:43 +08:00
go.sum Update: add cli entrance for sniffer 2021-11-14 21:17:43 +08:00
packets-mode.jpg Update: perfect docs 2021-11-15 01:18:00 +08:00
pcap.go Update: add cli entrance for sniffer 2021-11-14 21:17:43 +08:00
processes-mode.jpg Update: perfect docs 2021-11-15 01:18:00 +08:00
sniffer.go Update: perfect docs 2021-11-15 01:18:00 +08:00
stat.go Update: perfect docs 2021-11-15 01:18:00 +08:00
ui.go Update: add cli entrance for sniffer 2021-11-14 21:17:43 +08:00

README.md

sniffer

A modern alternative network traffic sniffer inspried by bandwhich(Rust) and nethogs(C++) project

Introduction

sniffer takes advantage of the gopacket library to sniff geiven network interfaces and records packets info. gopacket provides a Golang wrapper for libpcap written in C with additional functionality.

sniffer is a useful tool design for troubleshooting network issues since it can distinguish which process or connection causing the vast network traffic by different view modes. It's worth pointing out that sniffer is also responsive to the terminal window size, which makes it adapts all size of terminal automatically.

Installation

sniffer manipulates the libpcap library to capture user-level packets hence you need to have it installed first.

Debian/Ubuntu

sudo apt-get install libpcap-dev

CentOS/Fedora

sudo yum install libpcap libpcap-devel

MacOS

brew install libpcap

after that, install sniffer

go get github.com/chenjiandongx/sinffer

Usages

❯ sniffer -h
# A modern alternative network traffic sniffer.

Usage:
  sniffer [flags]

Examples:
  # processes mode for pid 1024,2048 in MB unit
  $ sniffer -p 1024 -p 2048 -m 2 -u MB

  # only capture the TCP protocol packets with lo,eth prefixed devices
  $ sniffer -b tcp -d lo -d eth

Flags:
  -b, --bpf string                   specify string pcap filter with the BPF syntax (default "tcp or udp")
  -d, --devices-prefix stringArray   prefixed devices to monitor (default: any devices)
  -h, --help                         help for sniffer
  -i, --interval int                 interval for refresh rate in seconds (default 1)
  -m, --mode int                     view mode of sniffer (0: bytes 1: packets 2: processes)
  -n, --no-dns-resolve               disable the DNS resolution
  -p, --pids ints                    pids to watch in processes mode (default all processes)
  -u, --unit string                  unit of traffic stats in processes mode, optional: B, KB, MB, GB (default "KB")
  -v, --version                      version for sniffer

View Mode

Bytes Mode: display traffic stats in bytes by the Table widget.

Packets Mode: display traffic stats in packets by the Table widget.

Processes Mode: display traffic stats groups by process using Plot widget.

License

MIT ©chenjiandongx