kung-foo / freki Goto Github PK

• Log all packets into one file
• One pcap per connection
• Enable pcap logging in the config file
• Pcap logging per IP address
• Pcap per port/protocol

test

Freki flush connection table after every 60 seconds, I am using type conn_handler to handle my ssh traffic, so no ssh session could survive longer than 1 minute. That would be great if user could define this timeout. or you can exclude like:
if md.Added.Before(threshold) && md.Rule.Type != "conn_handler" { delete(t.table, ck) }
my quick fix :)

My system connects to the internet via a HTTP proxy. I saw the documentation specified freki usage while on a TCP proxy (which I assume must be SOCKS proxy), when I tried working with similar rules for HTTP proxy, I couldn't get freki working. Am I doing anything wrong, or is this support to be added to freki yet?

Enhancement: Freki proxy connection to docker container if container is already started. But containers (service) can be spawned automatically on connection. These containers will be created on the first connection with the desired service. Individual container can be used per address to give attacker real like environment. On startup system will make sure that images are present for services mentioned in rules file.

See: https://travis-ci.org/kung-foo/freki/builds/217959291

Freki crashes with error in connHandler
error: [user.tcp] accept tcp [::]:5000: accept4: too many open files
I think it is because of not closing connections passed to the user out of its boundary.
Ref: https://github.com/kung-foo/freki/blob/master/userconnhandler_tcp.go#L58

I need access to public address for using in my log messages which is private. You can enable exporting of public address?