1- DaemonLogger: Simple packet logging & soft tap daemon.
2- Version 1.2.1
1+ Network packet capture with security requirements
32
4- Copyright (C) 2006-2008 Sourcefire Inc.
5- Author: Martin Roesch <
[email protected] >
3+ Hello Everyone, I have build a network Traffic Capture with Encryption based on python and Daemonlogger.
4+ Who is interested can used.
5+ It was build with scalability in mind.
6+ For more information Please read the .PDF File !!!!!!!
67
7- This is a libpcap-based program. It has two runtime modes:
8-
9- 1) It sniffs packets and spools them straight to the disk and can daemonize
10- itself for background packet logging. By default the file rolls over when
11- 1 GB of data is logged.
12-
13- 2) It sniffs packets and rewrites them to a second interface, essentially
14- acting as a soft tap. It can also do this in daemon mode.
15-
16- These two runtime modes are mutually exclusive, if the program is placed in
17- tap mode (using the -o switch) then logging to disk is disabled.
18-
19- License:
20-
21- GPL v2. Make SURE you read the included COPYING file so that you understand
22- how this file is licensed by Sourcefire, even though it's under the GPL v2
23- there are some clarifications that we have made regarding the licensing of
24- this program.
25-
26- Requirements:
27-
28- * A recent version of libpcap.
29- * A recent version of libdnet.
30-
31- Usage:
32-
33- daemonlogger [switches] [bpf filter]
34-
35- Switches:
36-
37- -c <count> Capture <count> packets and exit.
38- -d Daemonize at startup.
39- -f <bpf file> Load BPF filter from <bpf file>.
40- -F Make disk output "packet-buffered". As each packet
41- is saved, it will be written to the output file rather
42- than being written only when the output buffer fills.
43- -g <group name> Set group ID to <group name>.
44- -h Print usage message.
45- -i <interface> Sniff packets from <interface>.
46- -l <path> Specify a <path> to write the pcap logfiles into.
47- -m <count> Write <count> log files and exit. If using Ringbufer mode
48- then write <count> files and delete the oldest file in the
49- set when you exceed <count> log files written. The
50- program will not exit when in this mode.
51- -M <pct> Used in concert with the -r ringbuffer switch this option
52- will write log files to the disk until it is at <pct>
53- utilization and then roll over and delete the oldest log
54- file. For example, "-M 90" would write files to the disk
55- until it is 90% utilized and then roll over and delete the
56- oldest file in the logging directory. If the -s "size"
57- switch is not set then the default log file size is 2GB.
58- -n <name> Set output filename prefix to <name>. Default is
59- "daemonlogger.pcap".
60- -o <outf> Disable packet logging and write packets received on
61- <interface> on <outf>. Activates tap mode.
62- Example: daemonlogger -i en0 -o gre0
63- -p <pidfile> Set an explicit <pidfile> filename. Default is
64- daemonlogger.pid.
65- -P <pidpath> Set an explicit <pidpath> directory. Default is /var/run.
66- -r Activate ringbuffer mode.
67- -s <size> Rollover the log file if it reaches <size> bytes.
68- -S <snaplen> Set the number of bytes to grab per packet to <snaplen>.
69- -t <time> Rollover the log file on time intervals. Append an 'm' to
70- rollover on minute boundaries, 'h' to rollover on hour
71- boundaries and 'd' to rollover on day boundaries. If no
72- interval selector is used then the default rollover
73- interval is in seconds.
74- For example, "-t 60" rolls the log file over every 60
75- seconds and "-t 2h" rolls the log file over every two
76- hours at the top of the hour. In the case of
77- minute/hour/day-based rollovers, the will round to the
78- next highest hour. For example, if the program is told to
79- rollover every 2 hours and is started 38 minutes into the
80- current hour it will add 2 to the current hour and
81- rollover as scheduled at the top of the hour at <current
82- hour> + 2. If the program was started at 13:38 it would
83- roll over the logfile at 15:00.
84- -T <chroot> Chroot directory to <chroot>.
85- -u <user name> Set user ID to <user name>.
86- -v Show daemonlogger version.
87- -z Select log file pruning behavior. Omitting this switch
88- results in the default mode being used where the oldest log
89- file in the logging directory is pruned. Setting the -z
90- switch changes the behavior so that Daemonlogger will prune
91- the oldest file from its current instantiation and leave
92- files from older runs in the same logging directory alone.
93-
94- BPF Filter:
95- You can specify BPF filter commands after the command line switches just
96- like in tcpdump or Snort.
97-
98- This code is largely untested and probably completely shoddy. YMMV. Write me
99- if you find bugs or want features!
8+ Regards
9+ Jorge
0 commit comments