DOKK / manpages / debian 12 / sniffglue / sniffglue.1.en
sniffglue(1) General Commands Manual sniffglue(1)

sniffglue - secure multithreaded packet sniffer

sniffglue [-vrpVh] [-n <threads>] device

sniffglue is a network sniffer written in rust. Network packets are parsed concurrently using a thread pool to utilize all cpu cores. Project goals are that you can run sniffglue securely on untrusted networks and that it must not crash when processing packets. The output should be as useful as possible by default.

-v, --verbose

Increase filter sensitivity to show more (possibly less useful) packets. The default only shows few packets, this flag can be specified multiple times. (maximum: 4)

-h, --help

Prints help information.

-p, --promisc

Set device to promiscuous mode.

-r, --read

Open device as pcap file.

-n, --threads threads

Specify the number of threads.

-V, --version

Prints version information. If -r was specified, open as pcap file instead.

Sniff with default filters (dhcp, dns, tls, http) from enp0s25:

sniffglue enp0s25

Increase the filter sensitivity (arp):

sniffglue -v enp0s25

Increase the filter sensitivity (cjdns, ssdp, dropbox, packets with valid utf8)

sniffglue -vv enp0s25

Almost everything

sniffglue -vvv enp0s25

Everything

sniffglue -vvvv enp0s25

Read a dump from sniff.pcap, with increased filter sensitivity and decode packets with 1 thread:

sniffglue -vvrn1 sniff.pcap

ethernet, ipv4, ipv6, arp, tcp, udp, http, tls, dns, dhcp, cjdns eth beacons, ssdp, dropbox beacons

To report a security issue please contact kpcyrd on ircs://irc.hackint.org.

To ensure a compromised process doesn't compromise the system, sniffglue uses seccomp to restrict the syscalls that can be used after the process started. This is done in two stages, first at the very beginning (directly after env_logger initialized) and once after the sniffer has been setup, but before packets are read from the network.

During the second stage, there's also some general hardening that is applied before all unneeded syscalls are finally disabled. Those are system specific, so a configuration file is read from /etc/sniffglue.conf. This config file specifies an empty directory for chroot and an unprivileged account in user that is used to drop root privileges.

The packet processing of sniffglue can be fuzzed using cargo-fuzz. Everything you should need is provided in the fuzz/ directory that is distributed along with its source code. Please note that this program links to libpcap which is not included in the current fuzzing configuration.

pcap(3PCAP), seccomp(2)

This program was originally written and is currently maintained by kpcyrd. Bug reports and patches are welcome on github:

https://github.com/kpcyrd/sniffglue
2023-02-07