sniffglue(1)                General Commands Manual               sniffglue(1)

NAME
       sniffglue - secure multithreaded packet sniffer

SYNOPSIS
       sniffglue [-vrpVh] [-n <threads>] device

DESCRIPTION
       sniffglue is a network sniffer written in rust. Network packets are
       parsed concurrently using a thread pool to utilize all cpu cores.
       Project goals are that you can run sniffglue securely on untrusted
       networks and that it must not crash when processing packets. The output
       should be as useful as possible by default.

OPTIONS
       -v, --verbose
           Increase filter sensitivity to show more (possibly less useful)
           packets. The default only shows few packets, this flag can be
           specified multiple times. (maximum: 4)

       -h, --help
           Prints help information.

       -p, --promisc
           Set device to promiscuous mode.

       -r, --read
           Open device as pcap file.

       -n, --threads threads
           Specify the number of threads.

       -V, --version
           Prints version information. If -r was specified, open as pcap file
           instead.

EXAMPLES
       Sniff with default filters (dhcp, dns, tls, http) from enp0s25:

           sniffglue enp0s25

       Increase the filter sensitivity (arp):

           sniffglue -v enp0s25

       Increase the filter sensitivity (cjdns, ssdp, dropbox, packets with
       valid utf8)

           sniffglue -vv enp0s25

       Almost everything

           sniffglue -vvv enp0s25

       Everything

           sniffglue -vvvv enp0s25

       Read a dump from sniff.pcap, with increased filter sensitivity and
       decode packets with 1 thread:

           sniffglue -vvrn1 sniff.pcap

PROTOCOLS
       ethernet, ipv4, ipv6, arp, tcp, udp, http, tls, dns, dhcp, cjdns eth
       beacons, ssdp, dropbox beacons

SECURITY
       To report a security issue please contact kpcyrd on
       ircs://irc.hackint.org.

   SECCOMP
       To ensure a compromised process doesn't compromise the system,
       sniffglue uses seccomp to restrict the syscalls that can be used after
       the process started. This is done in two stages, first at the very
       beginning (directly after env_logger initialized) and once after the
       sniffer has been setup, but before packets are read from the network.

   HARDENING
       During the second stage, there's also some general hardening that is
       applied before all unneeded syscalls are finally disabled. Those are
       system specific, so a configuration file is read from
       /etc/sniffglue.conf. This config file specifies an empty directory for
       chroot and an unprivileged account in user that is used to drop root
       privileges.

   FUZZING
       The packet processing of sniffglue can be fuzzed using cargo-fuzz.
       Everything you should need is provided in the fuzz/ directory that is
       distributed along with its source code. Please note that this program
       links to libpcap which is not included in the current fuzzing
       configuration.

SEE ALSO
       pcap(3PCAP), seccomp(2)

AUTHORS
       This program was originally written and is currently maintained by
       kpcyrd. Bug reports and patches are welcome on github:

           https://github.com/kpcyrd/sniffglue

                                  2024-01-07                      sniffglue(1)