StreamDump: tcp stream dump with BPF filter rules | bidirection | domain
What is StreamDump？
StreamDump is used to cut traffic packets from a pcap format file or network interface by quaternions(src_ip,src_port,dst_ip,dst_port), each TCP stream is stored in a separate pcap file, and any connection without data exchange for more than two minutes is considered disconnected.
- BPF filtering rules are supported and can be customized according to requirements.
- Support to capture the bidirectional data flow, the file’s name to be saved is formatted with
IP[Port]-IP[Port].pcap, the arguments used for the file’s name of the bidirectional data flow comes from the first captured package.
- Support capturing traffic from pcap format file or a network interface.
- Written in Golang, easy installation, and deployment, support cross-compilation.
go get github.com/google/gopacket
>go build -o streamdump streamdump.go
or download the compiled executable file.
Copyright (c) 2019 scu-igroup