Multiplatform C++ tool which captures network traffic into pcap-ng file and extends it with application tags.
The application tag consists of recognized application and its socket records. The socket record uniquely identifies group of packets which belong to one applications socket.
Application tags are appended to the end of the capture pcap-ng file as one Custom Block. Structure of the block is documented in thesis.pdf (Chapter 6).
- Works on Windows and Linux (FreeBSD and MacOS support will be added in the future)
- Uses PCAPNG so Wireshark can read the capture file as usual
- Windows: Npcap/WinPcap
- Linux: libpcap
The application was tested on the following platforms:
- Windows:
- Windows 10 (Npcap)
- Windows 7 (WinPcap)
- Linux:
- Ubuntu (15.04 LTS, 16.04 LTS)
- lubuntu (17.04)
- Debian (8 Jessie)
- Kali (2016.1, 2016.2)
Linux
git clone https://github.com/TheKuko/namon.git
cd namon
make
Windows
- Clone https://github.com/TheKuko/namon.git
- Download npcap-sdk into libs/ folder, extract it and rename extracted folder to npcap-sdk
- Build win32/namon.sln using Visual Studio
Final binary is located in bin/ folder.
* make - build the tool
* make debug - build the tool with debug info and without optimisations
* make test - run basic tests (**TODO**)
* make pack - create gzip file
* make doxygen - make doxygen documentation in doc/ folder
* make clean - clean compiled binary, archive file, object files and \*.dSYM files
* make clean-tests - clean compiled tests
* make clean-doc - delete generated documentation
namon [-v[<level>]] [-i <interface>] [-w <output_file>]
Argument | Description |
---|---|
-h , --help |
Show help message and exit. |
-v , --verbosity |
Select verbosity level 0(disabled), 1(error), 2(warning), 3(info). If no value is specified 1 is used by default. |
-i <interface> , --interface |
Capturing interface. If the tool is run without this parameter, available interfaces will be printed. |
-w <output_file> , --output-file |
Name of the output file. Default filename is namon_capturedTraffic.pcapng . |
Jozef Zuzelka
- Doxygen documentation
- ZUZELKA, Jozef. Network traffc capturing with application tags. Brno, 2017. Bachelor’s thesis. Brno University of Technology, Faculty of Information Technology. Supervisor Ing. Jan Pluskal (thesis.pdf)
- ZUZELKA, Jozef. Network Traffc Capture with Application Tags: Excel@FIT Conference (April 2017, Brno) (paper, poster)