fingerprint

Documentation

Overview

Package fingerprint provides protocol fingerprinting and traffic classification.

Index

• func FormatClassification(results []ClassifyResult) string
• func IdentifyOS(ttl int, windowSize int) string
• type Classifier
  • func NewClassifier() *Classifier
  • func (c *Classifier) Classify(data []byte) []ClassifyResult
• type ClassifyResult
• type DeviceFingerprint
• type Signature

Functions

func FormatClassification

func FormatClassification(results []ClassifyResult) string

FormatClassification formats classification results.

func IdentifyOS

func IdentifyOS(ttl int, windowSize int) string

IdentifyOS identifies OS from TCP/IP stack characteristics.

Types

type Classifier

type Classifier struct {
	// contains filtered or unexported fields
}

Classifier classifies network traffic by protocol.

func NewClassifier

func NewClassifier() *Classifier

NewClassifier creates a new traffic classifier.

func (*Classifier) Classify

func (c *Classifier) Classify(data []byte) []ClassifyResult

Classify classifies a packet and returns candidates.

type ClassifyResult

type ClassifyResult struct {
	Protocol   string  `json:"protocol"`
	Confidence float64 `json:"confidence"`
	Method     string  `json:"method"` // "magic", "pattern", "heuristic"
}

ClassifyResult represents a traffic classification result.

type DeviceFingerprint

type DeviceFingerprint struct {
	OS         string `json:"os"`
	TTL        int    `json:"ttl"`
	WindowSize int    `json:"window_size"`
	MSS        int    `json:"mss"`
}

DeviceFingerprint represents a device fingerprint.

type Signature

type Signature struct {
	Protocol string   `json:"protocol"`
	Magic    []byte   `json:"magic,omitempty"`
	Offset   int      `json:"offset"`
	Patterns []string `json:"patterns,omitempty"`
}

Signature represents a protocol fingerprint signature.