http://wiki.packet-o-matic.org/ 2012-05-19T00:38:00+02:00 http://wiki.packet-o-matic.org/ http://wiki.packet-o-matic.org/lib/images/favicon.ico text/html 2011-09-25T12:35:28+02:00 http://wiki.packet-o-matic.org/cable_isp_bpi?rev=1316946928&do=diff If your ISP is using BPI, the packets arriving to your modem are encrypted and cannot be read by your neighbors. If your ISP doesn't use BPI, anybody can easily read all your downstream traffic (data and voice in your receive direction)! Also, if your ISP is not in this list and you know it's using or not BPI, please add it ! text/html 2010-09-13T22:34:33+02:00 http://wiki.packet-o-matic.org/command_reference?rev=1284410073&do=diff Command reference General commands config write [filename] Write the current configuration. You can optionally specify a different file name. debug cli set <off,0-5> Set the debug level of the management console (CLI). debug cli show Display the current debug level. text/html 2009-10-04T16:26:53+02:00 http://wiki.packet-o-matic.org/configuration_examples?rev=1254666413&do=diff Packet-o-matic can be quite complicated due to the infinite number of possibilities it provides. Here are a few configuration example that you may find useful to understand how certain aspects can be configured. Scan for a DOCSIS stream using a DVB card The following example will scan for a DOCSIS stream. Once the stream is acquired, it will stay tuned on it. text/html 2007-11-22T10:33:14+02:00 http://wiki.packet-o-matic.org/conntrack_ipv4?rev=1195723994&do=diff conntrack_ipv4 This module identify IPv4 streams based on source and destination address. It doesn't have any parameter. text/html 2011-12-05T15:02:00+02:00 http://wiki.packet-o-matic.org/conntrack_ipv6?rev=1323093720&do=diff conntrack_ipv6 This module identify IPv6 streams based on source and destination address. It doesn't have any parameter. text/html 2010-12-22T09:39:11+02:00 http://wiki.packet-o-matic.org/conntrack_rtp?rev=1293007151&do=diff conntrack_rtp This module tracks RTP connections based on synchronization source (ssrc). It has a single parameter : * timeout This parameter specifies after how many seconds we assume that a RTP connection has finished. Default : 10 seconds text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/conntrack_tcp?rev=1293004524&do=diff conntrack_tcp This module tracks TCP connections based on the source and destination ports. It has many timers. Make sure you know what you are doing before changing them. * syn_sent_timer Specifies after how many seconds we assume a connection is closed or unresponsive after a TCP SYN was sent but none was received. Default : 180 seconds text/html 2009-04-10T14:44:07+02:00 http://wiki.packet-o-matic.org/conntrack_udp?rev=1239367447&do=diff conntrack_udp This module tracks UDP connections based on the source and destination port. It has a single parameter : * timeout This parameter specifies after how many seconds we assume that a UDP connection has finished. Default : 180 seconds text/html 2009-04-25T19:55:29+02:00 http://wiki.packet-o-matic.org/datastore_mysql?rev=1240682129&do=diff datastore_mysql This module connects to a MySQL database. * dbname Database name to connect to. Default : pom * host Host where the database resides. Default : localhost * port TCP port to connect to. Default : 0 * user Username to provide to MySQL when connecting to the database. Default : empty text/html 2010-10-31T15:56:27+02:00 http://wiki.packet-o-matic.org/datastore_postgres?rev=1288536987&do=diff datastore_postgres This module connects to a PostgreSQL database. * dbname Database name to connect to. Default : pom * host Host where the database resides. Default : localhost * port TCP port to connect to. Default : 5432 * user text/html 2009-04-10T15:01:03+02:00 http://wiki.packet-o-matic.org/datastore_sqlite?rev=1239368463&do=diff datastore_sqlite This module connects to a SQLite3 database. * dbfile Database file to use. This file will be created if it doesn't exists. Default : pom.db text/html 2009-09-01T20:34:36+02:00 http://wiki.packet-o-matic.org/datastore_usage_and_configuration?rev=1251830076&do=diff Datastore configuration To use a datastore, 3 steps are required. First you need to add the datastore to the configuration : pom> datastore add sqlite datastore1 Datastore "datastore1" added (type sqlite) Other datastore types such as postgres or mysql are available if the configure script found the required files. The command “show datastore” will show you the datastores currently configured, their state and their parameters : text/html 2012-02-15T16:18:19+02:00 http://wiki.packet-o-matic.org/dvbcards?rev=1329319099&do=diff This is a non exhaustive list of tested DVB cards. If yours is working or not and is not in the list, please add it. IMPORTANT : DVB-C cards work for EuroDOCSIS stream ONLY. Similarly, ASTC cards will only work for US (aka normal) DOCSIS. * DVB-C cards text/html 2008-12-05T22:54:25+02:00 http://wiki.packet-o-matic.org/fap?rev=1228514065&do=diff inputs pcap mode file * add parameter “quit on eof” use xmlrpc interface to simulate quit_on_eof mode directory * process every pcap files from a directory r305 targets new targets * target_googlechat (http, incoming/outgoing messages sent to both clients) * target_facebook (same shit as target_googlechat) * target_smtp * target_imap * target_nntp * target_dns (with datastore to correlate other targets ip addresses) text/html 2010-12-22T09:37:39+02:00 http://wiki.packet-o-matic.org/getting_started?rev=1293007059&do=diff Getting started First, start packet-o-matic. This will start the program without any configuration. packet-o-matic At this point, packet-o-matic listens on port 4655. Simply telnet it and start configuring it. telnet localhost 4655 You can also use the web interface. If you compiled it with xmlrpc-c support, start with the -X switch to enable the web interface. text/html 2009-02-15T18:30:46+02:00 http://wiki.packet-o-matic.org/helper_docsis?rev=1234719046&do=diff This helper doesn't do much. It's mainly a place holder for the resize function that allows other helper to dynamicaly change the size of the payload in the docsis header. text/html 2010-12-22T09:39:46+02:00 http://wiki.packet-o-matic.org/helper_ipv4?rev=1293007186&do=diff helper_ipv4 This helper will reassemble IPv4 fragments and put them in a single packet. It will then pass this new packet to the rule process for analysis. This way, layers above IPv4 don't have to care about this special case. It has only one parameter : text/html 2009-03-06T19:51:31+02:00 http://wiki.packet-o-matic.org/helper_ipv6?rev=1236365491&do=diff This helper doesn't do much for now. It's mainly a place holder for the resize function that allows other helper to dynamicaly change the size of the payload in the IPv6 header. text/html 2010-12-22T08:55:22+02:00 http://wiki.packet-o-matic.org/helper_pppoe?rev=1293004522&do=diff This helper doesn't do much. It's mainly a place holder for the resize function that allows other helper to dynamicaly change the size of the payload in the PPPoE header. text/html 2010-12-22T09:40:03+02:00 http://wiki.packet-o-matic.org/helper_rtp?rev=1293007203&do=diff This helper provide RTP reordering. It means that it will buffer datagrams that are received out of order and pass the in the right order to the rule processor. This way, the targets or any subsequent match don't have to care about the order of RTP packets since this helper ensure that packets are in the right order and not duplicate. This helper has two parameters : text/html 2009-04-10T14:45:27+02:00 http://wiki.packet-o-matic.org/helper_tcp?rev=1239367527&do=diff This helper provide TCP reassembly and reordering. It means that it will buffer packets that are received out of order and pass the in the right order to the rule processor. This way, the targets or any subsequent match don't have to care about the order of TCP packets since this helper ensure that packets are in the right order and not duplicate. This helper has two parameters : text/html 2011-05-07T11:49:25+02:00 http://wiki.packet-o-matic.org/input_docsis?rev=1304761765&do=diff This input reads packets from a DVB-C or an ATSC card from a DOCSIS stream. DOCSIS means Data Over Cable Service Interface Specification. This is the standard used by cable modems. Note that this only provide the downstream traffic since the upstream frequency is not in the supported range of any DVB-C card. text/html 2012-01-08T21:48:09+02:00 http://wiki.packet-o-matic.org/input_pcap?rev=1326055689&do=diff input_pcap Mode interface With this mode, you'll sniff packets from a specific interface. To avoid packet loss while using input pcap, you may want to increase the nice level when running packet-o-matic. You can also sniff from all the interfaces by specifying the interface name 'any'. When starting, it will show what output layer will be used. If you sniff from an interface, it will be either ethernet or linux_cooked for special interfaces like ppp interfaces. Parameters for this mode : text/html 2009-12-03T19:46:08+02:00 http://wiki.packet-o-matic.org/installation?rev=1259865968&do=diff Installation Dependencies * libxml2 : Required for parsing and writing the configuration. * libpcap : Required for input_pcap, target_pcap, target_tcpkill and target_inject. * xmlrpc-c : Required for XML-RPC interface and the web interface. * MySQL : Required to build datastore_mysql. * PostgreSQL : Required to build datastore_postgres. * SQLite 3 : Required to build datastore_sqlite. text/html 2010-12-22T08:55:23+02:00 http://wiki.packet-o-matic.org/match_80211?rev=1293004523&do=diff match_80211 This module matches wireless (802.11) frames. It has the following fields : Field name Field type Description src mac Source MAC address dst mac Destination MAC address bssid mac BSSID MAC address type uint8 802.11 frame type subtype uint8 802.11 frame sub-type text/html 2012-02-15T16:12:59+02:00 http://wiki.packet-o-matic.org/match_docsis?rev=1329318779&do=diff match_docsis This module match DOCSIS frames. See the DOCSIS specifications section 6.2.1.4 table 6-2 for the possible values and the meaning of the it's fields. It has the following fields : Field name Field type Description fc_type uint8 Frame control type (2 bits) fc_parm uint8 Frame parameter (5 bits) ehdr_on bool Extended header present (1 bit) text/html 2009-12-22T14:20:05+02:00 http://wiki.packet-o-matic.org/match_docsis_mgmt?rev=1261488005&do=diff match_docsis_mgmt This module match DOCSIS Management frames. It has the following fields : Field name Field type Description saddr mac Source MAC address daddr mac Destination MAC address dsap uint8 DDSAP ssap uint8 SSAP control uint8 Control version uint8 Version of DOCSIS supporting this packet type uint8 Type of management packet text/html 2010-12-22T09:40:19+02:00 http://wiki.packet-o-matic.org/match_ethernet?rev=1293007219&do=diff match_ethernet This module matches ethernet frames. It has the following fields : Field name Field type Description src mac Source MAC address dst mac Destination MAC address text/html 2010-12-22T09:40:37+02:00 http://wiki.packet-o-matic.org/match_icmp?rev=1293007237&do=diff match_icmp This module match ICMP packets. It has the following fields : Field name Field type Description type uint8 ICMP packet type code uint8 ICMP code text/html 2010-12-22T08:55:23+02:00 http://wiki.packet-o-matic.org/match_icmpv6?rev=1293004523&do=diff match_icmpv6 This module match ICMPv6 packets. It has the following fields : Field name Field type Description type uint8 ICMPv6 packet type code uint8 ICMPv6 code text/html 2009-04-10T11:22:01+02:00 http://wiki.packet-o-matic.org/match_ipv4?rev=1239355321&do=diff match_ipv4 This module match IPv4 packets also known as IP packets. It has the following fields : Field name Field type Description src ipv4 Source address dst ipv4 Destination address tos uint8 Type of service ttl uint8 Time to live text/html 2009-04-10T11:23:41+02:00 http://wiki.packet-o-matic.org/match_ipv6?rev=1239355421&do=diff match_ipv6 This module match IPv6 packets. This is the next generation of the IP protocol. It has the following parameters : Field name Field type Description src ipv6 Source address dst ipv6 Destination address flabel uint32 Flow label (20 bits) hlim uint8 Hop limit text/html 2009-04-10T11:20:31+02:00 http://wiki.packet-o-matic.org/match_linux_cooked?rev=1239355231&do=diff match_linux_cooked This module match raw frames. This is usually generated when sniffing from special interfaces which do have a special layer 2. For example PPP interface and the loopback interface 'lo' will create this type of frames. It has the following fields : text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/match_ppi?rev=1293004524&do=diff match_ppi This module match PPI headers. PPI stands for Per Packet Information. See here for the specifications. This match has no field at the moment. text/html 2010-12-22T09:40:55+02:00 http://wiki.packet-o-matic.org/match_ppp?rev=1293007255&do=diff match_ppp This module match PPP headers. PPP stands for Point-to-Point Protocol. This match has no field at the moment. text/html 2012-02-15T16:12:59+02:00 http://wiki.packet-o-matic.org/match_pppoe?rev=1329318779&do=diff match_pppoe This module match PPPoE packets. It has the following fields : Field name Field type Description code uint8 PPPoE code session uint16 PPPoE session ID text/html 2009-04-10T11:24:38+02:00 http://wiki.packet-o-matic.org/match_prism?rev=1239355478&do=diff match_prism This module match prism2 or AVS headers. This match has no field at the moment. text/html 2010-12-22T09:41:06+02:00 http://wiki.packet-o-matic.org/match_radiotap?rev=1293007266&do=diff match_radiotap This module match radiotap or AVS headers. This match has no field at the moment. text/html 2010-12-22T09:41:18+02:00 http://wiki.packet-o-matic.org/match_rtp?rev=1293007278&do=diff match_rtp This module match RTP packets. RTP packets are most of the time encapsulated in UDP datagrams. Because of this, it's impossible to determine that a UDP datagram contains a RTP packet. You have to tell packet-o-matic that a packet contains RTP packet or it won't be able to find it out. This is done simply by creating a rule that containes the RTP layer. For example, the following rule assume that all UDP datagrams from 10.0.0.0/8 are RTP packets : text/html 2010-12-22T09:41:27+02:00 http://wiki.packet-o-matic.org/match_tcp?rev=1293007287&do=diff match_tcp This module match TCP segments. It has the following fields : Field name Field type Description sport uint16 Source port dport uint16 Destination port flags uint8 TCP flags (URG, ACK, PSH, RST, SYN, FIN) seq uint32 Sequence number ack uint32 Acknowledgment number win uint16 Window text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/match_udp?rev=1293004524&do=diff match_udp This module match UDP datagrams. It has the following fields : Field name Field type Description sport uint16 Source port dport uint16 Destination port text/html 2010-12-22T09:41:39+02:00 http://wiki.packet-o-matic.org/match_undefined?rev=1293007299&do=diff match_undefined This match is used internally by packet-o-matic and should not be used in your rules. text/html 2010-12-22T09:41:55+02:00 http://wiki.packet-o-matic.org/match_vlan?rev=1293007315&do=diff match_vlan This module matches VLAN frames also known as 802.1Q. It has the following fields : Field name Field type Description vid uint16 VLAN id text/html 2010-04-18T15:59:20+02:00 http://wiki.packet-o-matic.org/pom-ng_ideas?rev=1271599160&do=diff * parallelize processing of match/target threads * Windows support from scratch * multi input * have match for layer 5->7 as well * pass the payload instead of the packet * separate process for input and drop priv for others text/html 2009-07-04T18:06:03+02:00 http://wiki.packet-o-matic.org/rules_syntax?rev=1246723563&do=diff Rules syntax Syntax You can either match a protocol or a specific parameter of this protol. To match a protocol: <match> Example : ipv4 To match a specific field : <match>.<field> <op> <value> Example : ipv4.src == 10.0.0.0/8 Implemented matches : 80211, docsis, ethernet, icmp, icmpv6, ipv4, ipv6, linux_cooked, ppi, prism, radiotap, rtp, tcp, udp, vlan. See the documentation of each match for their implemented fields. text/html 2011-06-16T15:14:24+02:00 http://wiki.packet-o-matic.org/start?rev=1308230064&do=diff About Packet-o-matic is a free software that process network packets in real time and provide different kind of output. It's fully modular and easily extensible. Don't hesitate to report bugs, feature requests and comments to <gmsoft@tuxicoman.be>. text/html 2009-04-09T22:54:01+02:00 http://wiki.packet-o-matic.org/target_display?rev=1239310441&do=diff target_display This target will display information about the matched packets. Mode normal In this mode, informations about packet headers will be displayed. Here are the parameters of this target : * skip Number of headers to skip in the packet. For example, if you don't want to see the informations about the ethernet layer, set skip to 1. Default : 0 text/html 2009-04-09T22:54:16+02:00 http://wiki.packet-o-matic.org/target_dump_payload?rev=1239310456&do=diff This target dumps the payload of the matched packets. Each connection will be dumped into separate files. This target has the following parameters : * prefix Prefix of the files including the path. For example, a prefix of '/tmp/dump' will create files in /tmp and named dump-XXXXXXXX. The prefix supports variable expansion. See File path expansion for more details. Default : dump text/html 2010-12-22T08:55:23+02:00 http://wiki.packet-o-matic.org/target_http?rev=1293004523&do=diff This target will dump part of the HTTP traffic into usable files. It uses the Mime-Type provided by the server and a database in flat file format to match the right files to dump. It has the following parameters : * prefix Prefix of the files including the path. For example, a prefix of '/tmp/dump' will create files in /tmp and named dump-XXXXXXXX. The prefix supports variable expansion. See File path expansion for more details. Default : /tmp/ text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/target_inject?rev=1293004524&do=diff target_inject This target simply reinject the matched packets to the specified interface. The target need an ethernet layer to reinject the packets. This target has only one parameter : * interface Interface where to reinject packet to. Default : eth0 text/html 2009-04-09T22:53:38+02:00 http://wiki.packet-o-matic.org/target_irc?rev=1239310418&do=diff target_irc This target will dump the IRC connection into separate files into a irssi-like log format. It has the following parameters : * path Where to save the log files. The path supports variable expansion. See File path expansion for more details. Default : /tmp text/html 2009-04-09T22:56:54+02:00 http://wiki.packet-o-matic.org/target_msn?rev=1239310614&do=diff target_msn This target will look at MSN connections and conversations and avatars. This is still beta code and may not always work. It has the following parameters : * path Where to save the files. The path supports variable expansion. See File path expansion for more details. Default : /tmp text/html 2008-08-04T12:54:21+02:00 http://wiki.packet-o-matic.org/target_null?rev=1217847261&do=diff target_null This target does nothing specific. It only prints “Packet processed” on debug level 4. text/html 2009-04-09T22:52:15+02:00 http://wiki.packet-o-matic.org/target_pcap?rev=1239310335&do=diff target_pcap This target will save the matched packets into a pcap file. This is the same format used by tcpdump and wireshark. It has the following parameters : Mode default * filename File where to save the packets. Default : dump.cap * snaplen text/html 2010-12-22T09:42:12+02:00 http://wiki.packet-o-matic.org/target_pop?rev=1293007332&do=diff target_pop This target will look at POP connections and dump logins and retrieved emails into a maildir structure. The login information will be saved in the file named logins at the root of the maildir. It has the following parameters : * datastore_path : text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/target_rtp?rev=1293004524&do=diff This target dumps RTP packets into wave files. It currently supports the codecs G.711U, G.711A and G.722. This target need to find a rtp header in the packet it process. A typical rule will look like this : ipv4.src == 10.1.2.0/24 | udp | rtp It has the following parameters : text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/target_tap?rev=1293004524&do=diff target_tap This target will create a new interface and send all the matched packets to it. You need to have “Universal TUN/TAP device driver support” aka CONFIG_TUN in your kernel. If compiled as a module, run the following command to load it : text/html 2010-12-22T08:55:24+02:00 http://wiki.packet-o-matic.org/target_tcpkill?rev=1293004524&do=diff target_tcpkill This target will send TCP RST packets for each tcp packet it receive. This closes the TCP connection immediately. It supports either TCP packets over ipv4, over ipv6 or even over ipv6 tunneled into ipv4. Mode interface In this mode, packets are sent directly to an interface. It has the following parameters : text/html 2009-04-09T22:56:04+02:00 http://wiki.packet-o-matic.org/target_tftp?rev=1239310564&do=diff target_tftp This target will dump TFTP traffic into files. Mode dump * path Where to save the files. The path supports variable expansion. See File path expansion for more details. Default : /tmp text/html 2009-04-29T16:05:39+02:00 http://wiki.packet-o-matic.org/tips_and_tricks?rev=1241013939&do=diff Tips and tricks File path expansion Some target support file path expansion. For example target_http can have the following prefix configured : prefix = /mnt/data/${ipv4.src}/${tcp.sport}/http/dump- If the connection is established from 10.0.0.1 and the source port is 3000, the new directory /mnt/data/10.0.0.1/3000/http/ will be created and files will be put there. text/html 2009-03-08T02:30:05+02:00 http://wiki.packet-o-matic.org/todo?rev=1236475805&do=diff Core * Add pre-defined values to ptype * Add SNMP interface * Add support for more than one input at the same time Targets * Code some more targets : netflow, ftp, dnsspoof, ... Inputs * Code input to handle different file format (ms, ...) text/html 2009-09-06T16:34:24+02:00 http://wiki.packet-o-matic.org/twinhan_vp-2033?rev=1252247664&do=diff Twinhan VP-2033 This card is also known as Azureware AD-CP300. The development of drivers for this card (and the rest of the Mantis based cards) is pretty much dead and most of the information found on the net is old. The driver that most information refers to is to be found at <http://jusst.de/hg/mantis>. But this is a old driver that uses the Multiproto API. Multiproto is not a part of the kernel, more info about it can be found here; <http://www.linuxtv.org/wiki/index.php/Multiproto> … text/html 2010-01-23T17:02:13+02:00 http://wiki.packet-o-matic.org/xml-rpc_interface?rev=1264262533&do=diff XML-RPC interface The XML-RPC interface allow easy configuration of packet-o-matic by remote applications. The arguments can be either strings (s/) or integers (i/). By default, packet-o-matic listens on TCP port 8080 and the path for the XML-RPC queries is /RPC2. If you did specify a password for the XML-RPC interface, the user will be 'admin'.