Skip to content

Conversation

@MaxGroot
Copy link
Contributor

Thanks for open-sourcing this project. We have used Tulip during a CTF with a few patches of our own that we'd now like to contribute back into the original project.

This pull requests adds (semi-realtime) streaming PCAP support to Tulip by utilizing PCAP-over-ip, as well as BPF support for both file-based and PCAP-over-ip based traffic ingestion.

We wanted lower-latency traffic streaming and opted for PCAP-over-ip. As Tulip did not yet support this, we added PCAP-over-ip support. While we opted to combine this with pcap-broker to stream traffic from remote hosts, any pcap-over-ip server is supported.

This pull requests also adds support for adding a BPF filter, as we captured traffic once and distributed it to multiple listeners, for each of which we'd set the appropriate BPF. While we needed the BPF filter for PCAP-over-ip only, we also added it to the pcap file processing logic.

Copy link
Member

@Sijisu Sijisu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for contributing to Tulip!

Here are couple of small cosmetic changes I'd like, other than that LGTM!

Co-authored-by: Sijisu <mail@sijisu.eu>
Co-authored-by: Kristinn Vikar Jónsson <93918469+KristinnVikar@users.noreply.github.com>
@Sijisu
Copy link
Member

Sijisu commented Jul 26, 2023

Thanks @KristinnVikar for valuable fixes!

@Sijisu Sijisu merged commit c4ec0ff into OpenAttackDefenseTools:master Jul 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants