caronte v1.21.2 releases: analyze the network flow during attack/defence

by do son · Published May 21, 2021 · Updated June 30, 2022

caronte

Caronte is a tool to analyze the network flow during the capture of the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using protocol-specific rules. The connection flows are saved into a database and can be visualized with the web application. REST API is also provided.

Features

immediate installation with docker-compose
no configuration file, settings can be changed via GUI or API
pcaps to be analyzed can be loaded via curl, either locally or remotely, or via the GUI
- it is also possible to download the pcaps from the GUI and see all the analysis statistics for each pcap
rules can be created to identify connections that contain certain strings
- pattern matching is done through regular expressions (regex)
- regex in UTF-8 and Unicode format are also supported
connections can be labeled by type of service, identified by the port number
- each service can be assigned a different color
ability to filter connections by addresses, ports, dimensions, time, duration, matched rules
a timeline shows statistics with different metrics sampled per minute
- some of these metrics are connections_per_service, client_bytes_per_service, server_bytes_per_service, duration_per service, matched_rules
  - with the matched_rules metric, it can be possible to see the relationship between flag_in and flag_out
- the timeline contains a sliding window which can be used to search for connections in a certain time interval
advanced search by term negated term, exact phrase, regex, negated regex
- the performed searches are saved to be instantly repeated the following times
the detected HTTP connections are automatically reconstructed
- HTTP requests can be replicated through curl, fetch and python requests
- compressed HTTP responses (gzip/deflate) are automatically decompressed
ability to export and view the content of connections in various formats, including hex and base64
JSON content is displayed in a JSON tree viewer, HTML code can be rendered in a separate window
occurrences of matched rules are highlighted in the connection content view
supports both IPv4 and IPv6 addresses
- if more addresses are assigned to the vulnerable machine to be defended, a CIDR address can be used

Changelog v1.21

Replace Travis CI with Github Actions
Docker image in now published on Github Registry
Add CHANGELOG.md
Update Dockerfile to separate Go build and npm build stages
Update backend and frontend dependencies
Added a control to not wrap regex around slashes if the user add a pattern that already has slashes