mongocaputils

README

mongocaputils

utilities for handling mongo pcap files

license: ISC

tools

mongocapcat - turns mongo pcap files into bson/json

installation:

$ go get github.com/gabrielrussell/mongocaputils/cmd/mongocapcat

usage:

$ tcpdump -i lo0 -w some_mongo_cap.pcap 'dst port 27017'
$ mongocapcat -f=some_mongo_capture.pcap

Documentation

Overview

package mongocaputils provides utilities for working with mongodb pcap files

Index

• type MongoOpStream
  • func NewMongoOpStream(heapBufSize int) *MongoOpStream
  • func (s *MongoOpStream) Close() error
  • func (s *MongoOpStream) New(a, b gopacket.Flow) tcpassembly.Stream
  • func (s *MongoOpStream) SetFirstSeen(t time.Time)
• type OpWithTime
  • func (o *OpWithTime) Execute(session *mgo.Session) error
• type PacketHandler
  • func NewPacketHandler(pcapHandle *pcap.Handle) *PacketHandler
  • func (p *PacketHandler) Handle(streamHandler StreamHandler, numToHandle int) error
• type SetFirstSeener
• type StreamHandler

Types

type MongoOpStream

type MongoOpStream struct {
	Ops chan OpWithTime

	FirstSeen time.Time
	// contains filtered or unexported fields
}

func NewMongoOpStream

func NewMongoOpStream(heapBufSize int) *MongoOpStream

func (*MongoOpStream) Close

func (s *MongoOpStream) Close() error

func (*MongoOpStream) New

func (s *MongoOpStream) New(a, b gopacket.Flow) tcpassembly.Stream

func (*MongoOpStream) SetFirstSeen

func (s *MongoOpStream) SetFirstSeen(t time.Time)

type OpWithTime

type OpWithTime struct {
	mongoproto.OpRaw
	Seen       time.Time
	PlayAt     time.Time `bson:",omitempty"`
	EOF        bool      `bson:",omitempty"`
	Connection string
}

func (*OpWithTime) Execute

func (o *OpWithTime) Execute(session *mgo.Session) error

type PacketHandler

type PacketHandler struct {
	Verbose bool
	// contains filtered or unexported fields
}

func NewPacketHandler

func NewPacketHandler(pcapHandle *pcap.Handle) *PacketHandler

func (*PacketHandler) Handle

func (p *PacketHandler) Handle(streamHandler StreamHandler, numToHandle int) error

type SetFirstSeener

type SetFirstSeener interface {
	SetFirstSeen(t time.Time)
}

type StreamHandler

type StreamHandler interface {
	tcpassembly.StreamFactory
	io.Closer
}