Murzaby/sniffnet
1
0
Fork 0
mirror of https://github.com/GyulyVGC/sniffnet.git synced 2026-10-21 22:51:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

updated README (troubleshooting TODO)

Browse source
This commit is contained in:
Giuliano Bellini s294739 2022-11-17 12:18:30 +01:00
parent b67fe3eb19
commit f93305c59a
1 changed files with 39 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

124
README.md
View file

@ -3,8 +3,8 @@
<hr>
<p align="center"> Application to comfortably monitor your network traffic. </p>
<p align="center"> Multithreaded, cross-platform, reliable. </p>
<p align="center"> Application to comfortably monitor your network traffic </p>
<p align="center"> Multithreaded, cross-platform, reliable </p>
<p align="center">
<a href="https://crates.io/crates/sniffnet"><img alt="" src="https://img.shields.io/crates/v/sniffnet?color=orange&logo=rust"/></a>
@ -15,24 +15,28 @@
<hr>
<p align="center"><img src="resources/sniffnet_run_example.gif" width="85%"/></p>
<p align="center"><img alt="" src="resources/sniffnet_run_example.gif" width="85%"/></p>
TO BE CONTINUED.......
<div align="center">
<p style="width:85%">Sniffnet is a simple yet robust packet sniffer developed with the aim to let people have a glance into their network traffic without pain,
in a straightforward and comprehensible way </p>
</div>
<hr>
## Install
## Install & Run
The application binary can be installed with ```cargo install sniffnet```
If you have [Rust installed](https://www.rust-lang.org/tools/install) on your machine, the application binary can be installed with ```cargo install sniffnet```
The application can then be run using ```sniffnet [OPTIONS]```
Otherwise, you can install Sniffnet through the installers available in the [latest release](https://github.com/GyulyVGC/sniffnet/releases)
<details>
<summary>Build on Windows&emsp;<img alt="" src="https://user-images.githubusercontent.com/100347457/193474292-d84f2a96-f445-40ac-8930-9d0f00a3c2bb.png" width="35px"/></summary>
<br>
In order to build and run Sniffnet on Windows systems you need to:
<summary>Windows dependencies&emsp;<img alt="" src="https://user-images.githubusercontent.com/100347457/193474292-d84f2a96-f445-40ac-8930-9d0f00a3c2bb.png" width="35px"/></summary>
In order to correctly run Sniffnet on Windows systems you need to:
- Install [Npcap](https://npcap.com/#download).
@ -45,95 +49,45 @@ The application can then be run using ```sniffnet [OPTIONS]```
<details>
<summary>Build on Linux&emsp;<img alt="" src="https://user-images.githubusercontent.com/100347457/193474239-c48d37af-d4c1-4a94-9207-0d46c6d75f1f.png" width="35px"/></summary>
<br>
<summary>Linux dependencies&emsp;<img alt="" src="https://user-images.githubusercontent.com/100347457/193474239-c48d37af-d4c1-4a94-9207-0d46c6d75f1f.png" width="35px"/></summary>
In order to build and run Sniffnet on Linux systems, install the libraries and header files for the libpcap library:
`sudo apt-get install libpcap-dev`
In order to correctly run Sniffnet on Linux systems, install the libraries and header files for the libpcap library:
`sudo apt-get install libpcap-dev`
Note that if you are not running as root, you need to set capabilities like so:
`sudo setcap cap_net_raw,cap_net_admin=eip ~/.cargo/bin/sniffnet`
Note that if you are not running as root, you need to set capabilities to inspect a network adapter:
`sudo setcap cap_net_raw,cap_net_admin=eip <YOUR/SNIFFNET/EXECUTABLE/PATH>`
</details>
<details>
<summary>Build on MacOS&emsp;<img alt="" src="https://user-images.githubusercontent.com/100347457/193474398-7637e269-3e92-44bc-87c0-8ea18ca95693.png" width="35px"/></summary>
<br>
<summary>MacOS dependencies&emsp;<img alt="" src="https://user-images.githubusercontent.com/100347457/193474398-7637e269-3e92-44bc-87c0-8ea18ca95693.png" width="35px"/></summary>
MacOS natively has all the dependencies you need to build and run Sniffnet!
</details>
## Graphical report
## Features
<details>
<summary>See details</summary>
- choose a network adapter to inspect
- select filters to apply to the observed traffic:
* IP version
* transport protocol
* application protocol
- view real-time charts about traffic intensity (bytes and packets per second, incoming and outgoing)
- view overall statistics about the filtered traffic
- view most relevant connections (most recent, most packets, most bytes)
- save textual report with detailed information for each connection:
* source and destination IP addresses
* source and destination ports
* carried protocols
* amount of exchanged packets and bytes
* initial and final timestamp of information exchange
<br>
The graphical report consists of a svg file, constantly updated while Sniffnet is running.
It is suggested to open this file with a web browser, in order to be able to comfortably refresh it.
It reports the amount of sent (outgoing) and received (incoming) bits and packets per second.
<img alt="" src="https://user-images.githubusercontent.com/100347457/192573923-b4dc0d03-21c3-44b3-924a-ced1d0f4c8f0.svg" width="100%"/>
Note that the number of bits and packets in the graph refers to one single second even if the update frequency is different.
The default update frequency is set to 5 seconds, but you can change it launching the application with the ```-i``` option.
Note that the default interval of 5 seconds is more suitable if the network traffic is constant and steady (e.g., large file download);
in case of intermittent traffic, you can consider using a lower time interval.
</details>
## Textual reports
<details>
<summary>See details</summary>
### statistics.txt
This file contains details and statistics about the sniffing process.
<p align="center">
<img alt="" src="https://user-images.githubusercontent.com/100347457/193475549-d4368750-e449-4c31-b69d-7d284f242866.png" width="50%"/>
</p>
First, it specifies the name of the network adapter analyzed.
Then there is a detail about the initial timestamp of the sniffing process and the last timestamp in which the report was updated.
It also describes the status of the possible filters applicable by the user through the command line: IP address version, transport layer protocol, port minimum and maximum number, and application layer protocol.
Finally, it reports some statistics about the observed traffic: the number of [address:port] pairs considered, the total number
of sniffed packets, the number (and percentage) of packets selected according to the active filters and a list of the
observed application layer protocols with the respective packets count.
### report.txt
This file contains a detailed analysis of the packets stream for each [address:port] pair.
This analysis results in a table in which each row represents an [address:port] pair with the relative statistics.
<p align="center">
<img alt="" src="https://user-images.githubusercontent.com/100347457/193475329-a3338a8f-620e-4b70-954c-f6b0bf6ab4f7.png" width="100%"/>
</p>
For each [address:port] pair it is reported the amount of exchanged data measured in number of packets and in number of bytes between the source and the destination.
For each [address:port] pair are reported the first and the last timestamp in which a packet was transmitted between that [address:port] pair.
Level 4 and level 7 carried protocols are also described (respectively transport layer and application layer protocols);
please note that application level protocols are just inferred from the transport port numbers.
</details>
## Supported application layer protocols