blob: 8a8c702c2bb52bf84cacddb44aefd6d6089fb694 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
glougloud - glouglou daemon, for network traffic visualisation in real time
=== Requirements ===
* libglouglou
Known to work on OpenBSD 5.1 and Linux 3.4
=== Installation ===
git clone git@meg:glouglou
sudo useradd -d /var/empty/ -s /sbin/nologin _glougloud
=== Usage ===
* Run the daemon
cd glouglou/glougloud/
sudo ./glougloud
It logs to /var/log/glougloud.
For the moment it monitors lo0 interface.
* Connect to the daemon
nc -vvv -u 127.0.0.1 4430 |hexdump -C
You get informations of traffic flowing on the monitored interface.
=== Notes on architecture and security ===
glougloud is architectured in 3 processes:
* main process, runs as root, opens the capture interfaces with
libpcap and resolves DNS names
* server process, runs as _glougloud user and chrooted in _glougloud
home, listens and accepts or refuses clients connections
* user process, runs as _glougloud user and chrooted in _glougloud
home, parses the captured network traffic and sends a summary to the
connected clients
The 3 processes exchanges messages througt messages, with OpenBSD imsg
framework.
Note that glougloud activates extra protections on pcap capture only
on OpenBSD by reimplementing some of libpcap functions, see
glougloud.c my_pcap_open_live()
|
