Directories
¶
| Path | Synopsis |
|---|---|
|
Package api serves the JSON API and the live WebSocket that the embedded dashboard runs on.
|
Package api serves the JSON API and the live WebSocket that the embedded dashboard runs on. |
|
Package auth password-protects the dashboard and API.
|
Package auth password-protects the dashboard and API. |
|
Package buildinfo answers one question: is this binary something we shipped, or something a developer just built?
|
Package buildinfo answers one question: is this binary something we shipped, or something a developer just built? |
|
Package capture defines the pluggable capture-source interface that every observation enters the pipeline through, plus the startup probe that decides which sources can actually run here.
|
Package capture defines the pluggable capture-source interface that every observation enters the pipeline through, plus the startup probe that decides which sources can actually run here. |
|
deputy
Package deputy implements Deputy Mode: watching this machine's own connections by reading the OS socket tables, with the owning process attached.
|
Package deputy implements Deputy Mode: watching this machine's own connections by reading the OS socket tables, with the owning process attached. |
|
patrol
Package patrol implements Patrol Mode: watching the whole network by passively capturing packets, rather than only this machine's own sockets.
|
Package patrol implements Patrol Mode: watching the whole network by passively capturing packets, rather than only this machine's own sockets. |
|
Package cli is the command-line surface.
|
Package cli is the command-line surface. |
|
Package config resolves where LAN Sheriff keeps its data and how it is configured.
|
Package config resolves where LAN Sheriff keeps its data and how it is configured. |
|
Package dispatch implements The Dispatch: peer-to-peer sharing between LAN Sheriff installations that the operator has explicitly paired.
|
Package dispatch implements The Dispatch: peer-to-peer sharing between LAN Sheriff installations that the operator has explicitly paired. |
|
Package enrich decorates observed endpoints with the detail that makes them legible: where they are, who owns them, and what they are called.
|
Package enrich decorates observed endpoints with the detail that makes them legible: where they are, who owns them, and what they are called. |
|
Package httpsec holds the HTTP hardening that sits in front of everything else: response headers, and the Host check that defends a loopback bind against DNS rebinding.
|
Package httpsec holds the HTTP hardening that sits in front of everything else: response headers, and the Host check that defends a loopback bind against DNS rebinding. |
|
Package netutil answers the two questions the rest of the app keeps asking: "is this address on my own network?" and "who am I?".
|
Package netutil answers the two questions the rest of the app keeps asking: "is this address on my own network?" and "who am I?". |
|
Package notify sends findings to somewhere outside this machine.
|
Package notify sends findings to somewhere outside this machine. |
|
Package pipeline turns raw capture observations into the flow events the rest of the application consumes, so that nothing downstream needs to know whether an observation came from a socket table or a packet capture.
|
Package pipeline turns raw capture observations into the flow events the rest of the application consumes, so that nothing downstream needs to know whether an observation came from a socket table or a packet capture. |
|
Package store is the bounded, self-pruning embedded database every view reads from.
|
Package store is the bounded, self-pruning embedded database every view reads from. |
|
Package suspicion is the rule engine behind the Wanted List.
|
Package suspicion is the rule engine behind the Wanted List. |
|
Package types holds the unified event model that every capture source normalizes into, so that nothing downstream of the normalizer has to care where an observation came from.
|
Package types holds the unified event model that every capture source normalizes into, so that nothing downstream of the normalizer has to care where an observation came from. |
|
Package web serves the dashboard, baked into the binary.
|
Package web serves the dashboard, baked into the binary. |
Click to show internal directories.
Click to hide internal directories.