Go to file
Jean-Louis Huynen 2624114144
Merge pull request #11 from D4-project/d4forward
add: [forwardredis] forward d4 redis queue to another d4 server
2020-04-24 11:23:10 +02:00
conf.sample chg: [input] d4 redis input config sample 2020-04-08 15:02:53 +02:00
media Improves README 2019-02-14 08:37:22 +01:00
.gitignore chg: [mod] bump d4-golang-util 2020-02-12 15:03:46 +01:00
LICENSE Relicensing to MIT 2019-01-07 10:25:49 +01:00
Makefile update .gitignore 2019-01-17 09:16:13 +01:00
README.md initial support for meta-headers 2019-02-28 11:26:28 +01:00
d4-goclient.go chg: [main] fix #10 2020-04-23 16:23:37 +02:00
d4-goclient_test.go Fix #4 2019-04-01 15:01:01 +02:00
go.mod chg: [input] functional d4 redis input 2020-04-08 08:34:29 +02:00
go.sum chg: [input] functional d4 redis input 2020-04-08 08:34:29 +02:00

README.md

d4-goclient

Release Software License Go Report Card

d4-goclient is a D4 project client (sensor) implementing the D4 encapsulation protocol.

The client can be used on different targets and architectures to collect network capture, logs, specific network monitoring and send it back to a D4 server.

For more information about the D4 project.

Installation

Fetch d4-goclient code and dependencies

go get github.com/satori/go.uuid
go get github.com/D4-project/d4-goclient

Use make to build binaries:

make arm5l  # for raspberry pi / linux
make amd64l # for amd64 / linux

Dependencies

  • golang 1.10 (tested)
  • go.uuid

Use

Launch a d4-server (if you don't have a server)

See https://github.com/D4-project/d4-core/tree/master/server $IP_SRV being the d4-server's address, $PORT its listening port

Configuration files

Part of the client configuration can be stored in folder containing the following files:

  • key: your Pre-Shared-Key
  • snaplen: default is 4096
  • source: stdin
  • destination: stdout, [fe80::ffff:ffff:ffff:a6fb]:4443, 127.0.0.1:4443
  • type: D4 packat type, see types
  • uuid: generated automiatically if empty
  • version: protocol version
  • rootCA.crt: optional : CA certificate to check the server certificate
  • metaheader.json: optional : a json file describing feed's meta-type types

Flags

  -c string
    	configuration directory
  -cc
    	Check TLS certificate against rootCA.crt
  -ce
    	Set to True, true, TRUE, 1, or t to enable TLS on network destination (default true)
  -cka duration
    	Keep Alive time human format, 0 to disable (default 30s)
  -ct duration
    	Set timeout in human format
  -rt duration
    	Time in human format before retry after connection failure, set to 0 to exit on failure (default 30s)
  -v	Set to True, true, TRUE, 1, or t to enable verbose output on stdout

Pipe data into the client

In the followin examples, destination is set to stdout.

Some file

cat /proc/cpuinfo | ./d4-goclient -c conf.sample/ |  socat - OPENSSL-CONNECT:$IP_SRV:$PORT,verify=0

tcpdump (libpcap) output, discarding our own traffic

$IP being the monitoring computer ip

tcpdump not dst $IP and not src $IP -w - | ./d4-goclient -c conf.sample/ |  socat - OPENSSL-CONNECT:$IP_SRV:$PORT,verify=0