OverviewGitHubHomepageGoDoc

Quickstart

For those who can't wait to get their hands dirty.

Capture traffic to create audit records

Read traffic live from interface, stop with Ctrl-C (SIGINT):

$ net capture -iface eth0

Read traffic from a dump file (supports PCAP or PCAPNG):

$ net capture -read traffic.pcap

Read audit records

Read a netcap dumpfile and print to stdout as CSV:

$ net dump -read TCP.ncap.gz

Show the available fields for a specific Netcap dump file:

$ net dump -fields -read TCP.ncap.gz

Print only selected fields and output as CSV:

$ net dump -read TCP.ncap.gz -select Timestamp,SrcPort,DstPort

Save CSV output to file:

$ net dump -read TCP.ncap.gz -select Timestamp,SrcPort,DstPort > tcp.csv

Print output separated with tabs:

$ net dump -read TPC.ncap.gz -tsv

Run with 24 workers and disable gzip compression and buffering:

Parse pcap and write all data to output directory (will be created if it does not exist):

Convert timestamps to UTC:

Show Audit Record File Header

To display the header of the supplied audit record file, the -header flag can be used:

Print Structured Audit Records

Audit records can be printed structured, this makes use of the proto.MarshalTextString() function. This is sometimes useful for debugging, but very verbose.

Print as CSV

This is the default behavior. First line contains all field names.

Print as Tab Separated Values

To use a tab as separator, the -tsv flag can be supplied:

Print as Table

The -table flag can be used to print output as a table. Every 100 entries the table is printed to stdout.

Print with Custom Separator

Output can also be generated with a custom separator:

Validate generated CSV output

To ensure values in the generated CSV would not contain the separator string, the -check flag can be used.

This will determine the expected number of separators for the audit record type, and print all lines to stdout that do not have the expected number of separator symbols. The separator symbol will be colored red with ansi escape sequences and each line is followed by the number of separators in red color.

The -sep flag can be used to specify a custom separator.

PreviousInstallationNextConfiguration

Last updated