gpi

README

Protocol Identification

Network traffic classification library written purely in GoLang. See godoc for more details.

Supported Protocols

• ICMPv4
• ICMPv6
• HTTP
• SMTP
• SSH
• SSL
• TLS
• DNS
• RPC
• RDP
• SMB
• FTP
• NetBIOS
• JABBER
• MQTT

Documentation

Index

• type Protocol
  • func Classify(packet gopacket.Packet) Protocol
  • func ClassifyByPorts(packet gopacket.Packet) Protocol
  • func (protocol Protocol) String() string
• type TCPModule
• type TCPModuleFTP
  • func (module TCPModuleFTP) Match(tcp *layers.TCP) bool
  • func (module TCPModuleFTP) Protocol() Protocol
• type TCPModuleHTTP
  • func (module TCPModuleHTTP) Match(tcp *layers.TCP) bool
  • func (module TCPModuleHTTP) Protocol() Protocol
• type TCPModuleSMTP
  • func (module TCPModuleSMTP) Match(tcp *layers.TCP) bool
  • func (module TCPModuleSMTP) Protocol() Protocol
• type TCPModuleSSH
  • func (module TCPModuleSSH) Match(tcp *layers.TCP) bool
  • func (module TCPModuleSSH) Protocol() Protocol
• type TCPModuleSSL
  • func (module TCPModuleSSL) Match(tcp *layers.TCP) bool
  • func (module TCPModuleSSL) Protocol() Protocol
• type TCPModuleTLS
  • func (module TCPModuleTLS) Match(tcp *layers.TCP) bool
  • func (module TCPModuleTLS) Protocol() Protocol
• type TCPModules
• type UDPModule
• type UDPModuleDNS
  • func (module UDPModuleDNS) Match(udp *layers.UDP) bool
  • func (module UDPModuleDNS) Protocol() Protocol
• type UDPModules

Types

type Protocol

type Protocol string

const (
	ProtocolICMPv4  Protocol = "ICMPv4"
	ProtocolICMPv6  Protocol = "ICMPv6"
	ProtocolHTTP    Protocol = "HTTP"
	ProtocolTLS     Protocol = "TLS"
	ProtocolSSL     Protocol = "SSL"
	ProtocolFTP     Protocol = "FTP"
	ProtocolSSH     Protocol = "SSH"
	ProtocolSMTP    Protocol = "SMTP"
	ProtocolDNS     Protocol = "DNS"
	ProtocolTCP     Protocol = "TCP"
	ProtocolUDP     Protocol = "UDP"
	ProtocolUnknown Protocol = "UNKNOWN"
)

func Classify

func Classify(packet gopacket.Packet) Protocol

Classify tries to identify network traffic by doing spot checks of the provided packet. The function will cache certain packages to improve detection rate

func ClassifyByPorts

func ClassifyByPorts(packet gopacket.Packet) Protocol

ClassifyByPorts will return protocol associated by the standard port mapping. This can be seen as fallback option in case e.g. the packet inspection of Classify returns ProtocolUnknown.

func (Protocol) String

func (protocol Protocol) String() string

type TCPModule

type TCPModule interface {
	Match(*layers.TCP) bool
	Protocol() Protocol
}

type TCPModuleFTP

type TCPModuleFTP struct{}

func (TCPModuleFTP) Match

func (module TCPModuleFTP) Match(tcp *layers.TCP) bool

func (TCPModuleFTP) Protocol

func (module TCPModuleFTP) Protocol() Protocol

type TCPModuleHTTP

type TCPModuleHTTP struct{}

func (TCPModuleHTTP) Match

func (module TCPModuleHTTP) Match(tcp *layers.TCP) bool

func (TCPModuleHTTP) Protocol

func (module TCPModuleHTTP) Protocol() Protocol

type TCPModuleSMTP

type TCPModuleSMTP struct{}

func (TCPModuleSMTP) Match

func (module TCPModuleSMTP) Match(tcp *layers.TCP) bool

func (TCPModuleSMTP) Protocol

func (module TCPModuleSMTP) Protocol() Protocol

type TCPModuleSSH

type TCPModuleSSH struct{}

func (TCPModuleSSH) Match

func (module TCPModuleSSH) Match(tcp *layers.TCP) bool

func (TCPModuleSSH) Protocol

func (module TCPModuleSSH) Protocol() Protocol

type TCPModuleSSL

type TCPModuleSSL struct{}

func (TCPModuleSSL) Match

func (module TCPModuleSSL) Match(tcp *layers.TCP) bool

func (TCPModuleSSL) Protocol

func (module TCPModuleSSL) Protocol() Protocol

type TCPModuleTLS

type TCPModuleTLS struct{}

func (TCPModuleTLS) Match

func (module TCPModuleTLS) Match(tcp *layers.TCP) bool

func (TCPModuleTLS) Protocol

func (module TCPModuleTLS) Protocol() Protocol

type TCPModules

type TCPModules []TCPModule

type UDPModule

type UDPModule interface {
	Match(*layers.UDP) bool
	Protocol() Protocol
}

type UDPModuleDNS

type UDPModuleDNS struct{}

func (UDPModuleDNS) Match

func (module UDPModuleDNS) Match(udp *layers.UDP) bool

func (UDPModuleDNS) Protocol

func (module UDPModuleDNS) Protocol() Protocol

type UDPModules

type UDPModules []UDPModule