atrent / prads Goto Github PK
View Code? Open in Web Editor NEWThis project forked from gamelinux/prads
Passive Real-time Asset Detection System
Home Page: http://gamelinux.github.com/prads/
This project forked from gamelinux/prads
Passive Real-time Asset Detection System
Home Page: http://gamelinux.github.com/prads/
#### PRADS README # ______ # | __ | __ # | _____|.----..------..--| |.-----. (tm) # | | | |-'| __ || _ |__ --' # |__| |__| |____|_||_____|______| # # Passive Real-time Asset Detection system! # # Baut' Is a `Passive Real-time Asset Detection System`. It passively listen to network traffic and gathers information on hosts and services it sees on the network. This information can be used to map your network, letting you know what services and hosts are active, and can be used together with your favorite IDS/IPS setup for "event to application" correlation. # As is! This program is served 'as is'. We take no responsabuility for anything :) # Lic GPL v2 or better? See LICENSE # Install See doc/INSTALL # USE There are several ways to use PRADS. PRADS has many commandline options, see the prads(1) man page. # Example prads -i eth0 -l prads.log If you run the prads service, the assets it sees will be dumped into /var/log/prads.log and look like this: 10.43.2.181,0,54354,6,SYN,[65535:64:1:64:M1460,N,W2,N,N,T,S,E,E:P:MacOS:iPhone OS 3.1.3 (UC):link:ethernet/modem:uptime:1574hrs],0,1300882012 10.43.2.181,0,0,0,ARP (Apple),C8:BC:C8:48:65:CA,0,1300882017 This information can be further processed, inserted into an SQL database etc. the general format fo this data is: asset,vlan,port,proto,service,[service-info],distance,discovered asset = The ip address of the asset. vlan = The virtual lan tag of the asset. port = The port number of the detected service. proto = The protocol number of the matching fingerprint. service = The "Service" detected, like: TCP-SERVICE, UDP-SERVICE, SYN, SYNACK,MAC,..... service-info= The fingerprint that the match was done on, with info. distance = Distance based on guessed initial TTL (service = SYN/SYNACK) discovered = The timestamp when the data was collected May it sniff your network for a while and you will be able to do anomaly detection. # SNORT (snort.org) The prads2snort script may be used to convert the prads log into a hosts_attribute.xml file that can be used by snort to decide fragmentation policies, for better event detection. http://snort.org/docs/snort_manual/node189.html # Sguil (sguil.net) You can feed events from PRADS straight into sguil replacing pads by using the sguil pads agent. PRADS supports the -f fifo argument and the 'fifo: /path/to/fifo' configuration option to feed events into a FIFO. # SQL database, WebGUI etc. This is on the agenda. There will be a webgui to the database, for easy browsing of your network.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.