badcapt
badcapt copied to clipboard
ilyaglow
Detect malicious packets
It’s a pure Go pcap handler, which is faster and doesn’t depend on CGO.
Related lines in the nmap sources: - https://github.com/nmap/nmap/blob/master/scan_engine_raw.cc#L300 - https://github.com/nmap/nmap/blob/master/scan_engine_raw.cc#L449 - https://github.com/nmap/nmap/blob/master/scan_engine_raw.cc#L466 - https://github.com/nmap/nmap/blob/master/scan_engine.h#L290 Depends on #4
Marking of a single packet is not enough sometimes to detect scanners like nmap and some types of attacks. The badcapt should use some kind of caching mechanisms for a...