glutton

README

Glutton

Glutton is a protocol-agnostic, low-interaction honeypot that intercepts network traffic and logs interactions to help analyze malicious activities. It's built using Golang and leverages iptables and TPROXY to redirect all traffic to specific protocol handlers.

Documentation

For more details, please read the documentation, which provides the following sections:

• Introduction
• Setup
• Configuration
• Extension
• FAQs

Documentation

Index

• type Glutton
  • func New(ctx context.Context) (*Glutton, error)
  • func (g *Glutton) ConnectionByFlow(ckey [2]uint64) connection.Metadata
  • func (g *Glutton) Init() error
  • func (g *Glutton) MetadataByConnection(conn net.Conn) (connection.Metadata, error)
  • func (g *Glutton) ProduceTCP(handler string, conn net.Conn, md connection.Metadata, payload []byte, ...) error
  • func (g *Glutton) ProduceUDP(handler string, srcAddr, dstAddr *net.UDPAddr, md connection.Metadata, ...) error
  • func (g *Glutton) Shutdown()
  • func (g *Glutton) Start() error
  • func (g *Glutton) UpdateConnectionTimeout(ctx context.Context, conn net.Conn) error
• type Server
  • func NewServer(tcpPort, udpPort uint) *Server
  • func (s *Server) Start() error

Types

type Glutton

type Glutton struct {
	Logger *slog.Logger
	Server *Server

	Producer *producer.Producer
	// contains filtered or unexported fields
}

Glutton struct

func New

func New(ctx context.Context) (*Glutton, error)

New creates a new Glutton instance

func (*Glutton) ConnectionByFlow

func (g *Glutton) ConnectionByFlow(ckey [2]uint64) connection.Metadata

ConnectionByFlow returns connection metadata by connection key

func (*Glutton) Init

func (g *Glutton) Init() error

Init initializes server and handles

func (*Glutton) MetadataByConnection

func (g *Glutton) MetadataByConnection(conn net.Conn) (connection.Metadata, error)

MetadataByConnection returns connection metadata by connection

func (*Glutton) ProduceTCP

func (g *Glutton) ProduceTCP(handler string, conn net.Conn, md connection.Metadata, payload []byte, decoded interface{}) error

func (*Glutton) ProduceUDP

func (g *Glutton) ProduceUDP(handler string, srcAddr, dstAddr *net.UDPAddr, md connection.Metadata, payload []byte, decoded interface{}) error

func (*Glutton) Shutdown

func (g *Glutton) Shutdown()

Shutdown the packet processor

func (*Glutton) Start

func (g *Glutton) Start() error

Start the listener, this blocks for new connections

func (*Glutton) UpdateConnectionTimeout

func (g *Glutton) UpdateConnectionTimeout(ctx context.Context, conn net.Conn) error

UpdateConnectionTimeout increase connection timeout limit on connection I/O operation

type Server

type Server struct {
	// contains filtered or unexported fields
}

func NewServer

func NewServer(tcpPort, udpPort uint) *Server

func (*Server) Start

func (s *Server) Start() error