Pkappa2

Pkappa2 is a packet stream analysis tool intended for Attack & Defense CTF Competitions. It receives pcap files via a http upload, usually send by a tcpdump-complete script. The received pcaps are processed and using the webinterface, users can run queries over the streams. Streams matching the query are displayed and their content can be viewed in multiple formats.

The tool is under development and might not work! See docs/TODO.md for missing features.

Add pcaps using a POST to /upload/filename.pcap:

curl --data-binary @some-file.pcap http://localhost:8080/upload/some-file.pcap

Running

• install required dependencies
  • libpcap (e.g. apt install libpcap-dev)
• run yarn install && yarn build in /web
• run go run cmd/pkappa2/main.go in /
• optionally, install stock converter python dependencies: pip install -r converters/pkappa2lib/requirements.txt
• visit localhost:8080 in your web browser

You likely want to add some arguments to the go run command, check -help

Docker

• copy .env.example to .env and change the configuration
• run docker compose up -d
• visit localhost:8080 in your web browser

UI Development

• make sure you can run Pkappa2
• for development with vscode: disable @builtin typescript extension and let Volar takeover for full typescript support in Vue files
• run yarn serve in /web
• run go run cmd/pkappa2/main.go -address :8081 in /
• visit localhost:8080 in your web browser

You can import multiple .pcap files in the current folder using: for f in *.pcap; do curl --data-binary "@$f" "http://localhost:8081/upload/$f"; done