Documentation
¶
Overview ¶
Package pcapgen writes a synthetic capture containing known, labelled attacker behaviour.
This exists for two reasons that turn out to be the same reason.
The demo reason: anyone who clones this repository can watch the sensor find real detections in one command, without needing a network to sniff, without downloading a malware sample, and without the legal and privacy problems that come with shipping a capture of somebody's actual traffic.
The engineering reason: the generator declares what it planted. That turns "does the detector work?" from an opinion into an assertion — the integration test replays this capture and requires that every planted behaviour is found and that nothing else fires. A detector that stops working, or starts crying wolf on the benign background traffic, fails the build.
Index ¶
Constants ¶
const (
Snaplen = 2048
)
Snaplen is the capture length recorded in the file header. Bulk-transfer packets are truncated to headerSnap, mirroring what a real sensor running with a small snaplen produces: full byte accounting, minimal file size.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Expectation ¶
type Expectation struct {
RuleID string `json:"rule_id"`
Src string `json:"src"`
Dst string `json:"dst,omitempty"`
Note string `json:"note"`
}
Expectation is a behaviour deliberately planted in the capture.
Source Files