namon

View the Project on GitHub jzlka/namon

Network Traffic Capturing With Application Tags

Build Status Build status

Multiplatform C++ tool which captures network traffic into pcap-ng file and extends it with application tags. The application tag consists of recognized application and its socket records. The socket record uniquely identifies group of packets which belong to one applications socket.
Application tags are appended to the end of the capture pcap-ng file as one Custom Block. Structure of the block is documented in thesis.pdf (Chapter 6).

Features

Dependencies

The application was tested on the following platforms:

Build

Linux

git clone https://github.com/TheKuko/namon.git
cd namon
make

Windows

  1. Clone https://github.com/TheKuko/namon.git
  2. Download npcap-sdk into libs/ folder, extract it and rename extracted folder to npcap-sdk
  3. Build win32/namon.sln using Visual Studio

Final binary is located in bin/ folder.

Makefile parameters

* make              - build the tool
* make debug        - build the tool with debug info and without optimisations
* make test         - run basic tests (**TODO**)
* make pack         - create gzip file
* make doxygen      - make doxygen documentation in doc/ folder
* make clean        - clean compiled binary, archive file, object files and \*.dSYM files
* make clean-tests  - clean compiled tests
* make clean-doc    - delete generated documentation

Program arguments

namon [-v[<level>]] [-i <interface>] [-w <output_file>]
Argument Description
-h, --help Show help message and exit.
-v, --verbosity Select verbosity level 0(disabled), 1(error), 2(warning), 3(info). If no value is specified 1 is used by default.
-i <interface>, --interface Capturing interface. If the tool is run without this parameter, available interfaces will be printed.
-w <output_file>, --output-file Name of the output file. Default filename is namon_capturedTraffic.pcapng.

Author

Jozef Zuzelka jozef.zuzelka@gmail.com

More information