Skip to content

Commit

Permalink
upgrade README
Browse files Browse the repository at this point in the history
  • Loading branch information
biandratti committed Dec 1, 2024
1 parent 8458b48 commit 073f2f8
Show file tree
Hide file tree
Showing 5 changed files with 61 additions and 20 deletions.
2 changes: 1 addition & 1 deletion Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 3 additions & 6 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
[package]
name = "passivetcp-rs"
version = "0.1.0-alpha.0"
edition = "2021"
description = "A Rust library for passive traffic fingerprinting [p0f]"
license = "MIT OR Apache-2.0"
description = "Passive traffic fingerprinting [p0f]"
license = "MIT"
authors = ["Maximiliano Biandratti <[email protected]>"]
repository = "https://github.com/biandratti/passivetcp-rs"
readme = "README.md"
Expand All @@ -18,10 +19,6 @@ log = "0.4.22"
lazy_static = "1.5.0"
ttl_cache = "0.5.1"

[lib]
name = "passivetcp"
path = "src/lib.rs"

[[example]]
name = "p0f"
path = "examples/p0f.rs"
57 changes: 45 additions & 12 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,18 +1,20 @@
### Get network Interface
```
ip link show
```
# Passive traffic fingerprinting
An experimental Rust library inspired by p0f, the well-known passive OS fingerprinting tool originally written in C. This library aims to bring the power of passive TCP/IP fingerprinting to the Rust ecosystem while offering a more modern, efficient, and extensible implementation.

### Process packages
```
cargo build --release --examples
sudo RUST_BACKTRACE=1 ./target/release/examples/p0f --interface <INTERFACE>
```
#### What is Passive TCP Fingerprinting?
Passive TCP fingerprinting is a technique that allows you to infer information about a remote host's operating system and network stack without sending any probes. By analyzing characteristics of the TCP/IP packets that are exchanged during a normal network conversation, passivetcp-rs provides insights into the remote system’s OS type, version, and network stack implementation.

#### This technique is useful for a variety of purposes, including:
- Network analysis: Identifying the types of devices and systems on a network without active scanning.
- Security: Discovering hidden or obscure systems by their network behavior.
- Fingerprinting for research: Understanding patterns in network traffic and improving security posture.
About passivetcp-rs

### A snippet of typical p0f output may look like this:
This Rust implementation of passive TCP fingerprinting is still in its experimental phase, and while it builds upon the established ideas of p0f, it is not yet feature-complete. The library currently provides basic functionality, but we plan to expand its capabilities as the project matures.

```
#### A snippet of typical p0f output may look like this:

```text
.-[ 1.2.3.4/1524 -> 4.3.2.1/80 (syn) ]-
|
| client = 1.2.3.4
Expand Down Expand Up @@ -48,4 +50,35 @@ sudo RUST_BACKTRACE=1 ./target/release/examples/p0f --interface <INTERFACE>
| raw_freq = 250.00 Hz
|
`----
```
```

### Installation
To use passivetcp-rs in your Rust project, add the following dependency to your `Cargo.toml`:
```toml
[dependencies]
passivetcp-rs = "0.1.0-alpha.0"
```

### Usage
Here’s a basic example of how to use passivetcp-rs:
```rust
use passivetcp_rs::db::Database;
use passivetcp_rs::P0f;

let args = Args::parse();
let interface_name = args.interface;
let db = Database::default();
let mut p0f = P0f::new(&db, 100);

let p0f_output = p0f.analyze_tcp(packet);
p0f_output.syn.map(|syn| println!("{}", syn));
p0f_output.syn_ack.map(|syn_ack| println!("{}", syn_ack));
p0f_output.mtu.map(|mtu| println!("{}", mtu));
p0f_output.uptime.map(|uptime| println!("{}", uptime));
```

### Contributing
This library is in its early stages, and contributions are very welcome. If you have ideas for additional features, bug fixes, or optimizations, please feel free to open issues or submit pull requests. We are particularly looking for help with extending the feature set and improving the performance of the library.

### License
This project is licensed under the MIT License.
10 changes: 10 additions & 0 deletions examples/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
### Get network Interface
```
ip link show
```

### Process packages
```
cargo build --release --examples
sudo RUST_BACKTRACE=1 ./target/release/examples/p0f --interface <INTERFACE>
```
3 changes: 2 additions & 1 deletion examples/p0f.rs
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
use clap::Parser;
use log::debug;
use passivetcp::{db::Database, P0f};
use pnet::datalink::{self, Config, NetworkInterface};
use passivetcp_rs::db::Database;
use passivetcp_rs::P0f;

#[derive(Parser, Debug)]
#[command(version, about, long_about = None)]
Expand Down

0 comments on commit 073f2f8

Please sign in to comment.