packetsnitch 1.5.604 → 1.5.606
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/FUNDING.yml +15 -0
- package/.webpack/x64/renderer/main_window/index.js +1 -1
- package/docs/Backend.md +278 -0
- package/docs/Filters.md +735 -0
- package/docs/Frontend.md +494 -0
- package/docs/README.md +43 -0
- package/docs/bitcoin-qr.png +0 -0
- package/docs/paypal-qr.png +0 -0
- package/docs/screenshots/PacketSnitch_ss10.png +0 -0
- package/docs/screenshots/PacketSnitch_ss9-2.jpg +0 -0
- package/docs/screenshots/comparison-operator-packetsnitch-ss21.png +0 -0
- package/docs/screenshots/packetSnitch_ss13.png +0 -0
- package/docs/screenshots/packetSnitch_ss20.png +0 -0
- package/docs/screenshots/packetsnitch-ss16.png +0 -0
- package/docs/screenshots/packetsnitch_32.png +0 -0
- package/docs/screenshots/packetsnitch_ss11.png +0 -0
- package/docs/screenshots/packetsnitch_ss12.png +0 -0
- package/docs/screenshots/packetsnitch_ss19.png +0 -0
- package/docs/screenshots/packetsnitch_ss23.png +0 -0
- package/docs/screenshots/packetsnitch_ss24.png +0 -0
- package/docs/screenshots/packetsnitch_ss25.png +0 -0
- package/docs/screenshots/packetsnitch_win_ss14.png +0 -0
- package/docs/screenshots/packetsntich_ss26.png +0 -0
- package/docs/screenshots/ps-views.gif +0 -0
- package/docs/screenshots/screenshot_7.png +0 -0
- package/docs/venmo-qr.png +0 -0
- package/forge.config.js +21 -33
- package/ideas/Dark-mode UI mockup for packetsnitch.png +0 -0
- package/ideas/Dark-packetsnitch-UI-mockup-5.png +0 -0
- package/ideas/PacketSnitch-timeline-landscape-mockup.png +0 -0
- package/ideas/Screenshot 2026-03-05 at 22-09-09 Packet Decoder Frontend /342/200/223 Figma Make.png +0 -0
- package/ideas/Screenshot 2026-03-07 at 12-31-05 Grok _ X.png +0 -0
- package/ideas/ideas.txt +340 -0
- package/logo/LidakzOne_PERSONAL_USE_ONLY.otf +0 -0
- package/logo/byline-packetsnitch.xcf +0 -0
- package/logo/logo-packetsnitch-2.png +0 -0
- package/logo/logo-packetsnitch-3.png +0 -0
- package/logo/logo-packetsnitch-4.png +0 -0
- package/logo/logo-packetsnitch-5.png +0 -0
- package/logo/logo-packetsnitch.png +0 -0
- package/logo/logo-packetsnitch.webp +0 -0
- package/logo/logo-packetsnitch.xcf +0 -0
- package/logo/packet-snitch-tag-transp-whitetext.png +0 -0
- package/logo/packet-snitch-tag-transp.png +0 -0
- package/logo/ps-icon.ico +0 -0
- package/logo/ps-installer-icon.ico +0 -0
- package/logo/qr-code(1).png +0 -0
- package/logo/qr-code.png +0 -0
- package/logo/rat-standing.png +0 -0
- package/package.json +2 -3
- package/samples/hosts.json +15112 -0
- package/samples/hustoj_capture.pcapng +0 -0
- package/spec.ejs +62 -0
- package/.eslintrc.json +0 -28
package/forge.config.js
CHANGED
|
@@ -1,64 +1,52 @@
|
|
|
1
|
-
const { FusesPlugin } = require(
|
|
2
|
-
const { FuseV1Options, FuseVersion } = require(
|
|
3
|
-
const path = require(
|
|
1
|
+
const { FusesPlugin } = require('@electron-forge/plugin-fuses');
|
|
2
|
+
const { FuseV1Options, FuseVersion } = require('@electron/fuses');
|
|
3
|
+
const path = require('path');
|
|
4
4
|
module.exports = {
|
|
5
5
|
packagerConfig: {
|
|
6
6
|
asar: true,
|
|
7
|
-
extraResource: [
|
|
8
|
-
icon: path.resolve(__dirname,
|
|
9
|
-
setupIcon: path.resolve(__dirname,
|
|
7
|
+
extraResource: ['./backend/'],
|
|
8
|
+
icon: path.resolve(__dirname, 'ps-icon.ico'),
|
|
9
|
+
setupIcon: path.resolve(__dirname, 'ps-icon.ico'),
|
|
10
10
|
},
|
|
11
11
|
rebuildConfig: {},
|
|
12
12
|
makers: [
|
|
13
13
|
{
|
|
14
|
-
name:
|
|
14
|
+
name: '@electron-forge/maker-squirrel',
|
|
15
15
|
config: {
|
|
16
|
-
name:
|
|
16
|
+
name: 'PacketSnitch',
|
|
17
17
|
},
|
|
18
18
|
},
|
|
19
|
-
// {
|
|
20
|
-
// name: "@electron-forge/maker-flatpak",
|
|
21
|
-
// config: {
|
|
22
|
-
// name: "org.oxasploits.packetsnitch",
|
|
23
|
-
// options: {
|
|
24
|
-
// categories: ["Video"],
|
|
25
|
-
// mimeType: ["video/h264"],
|
|
26
|
-
// },
|
|
27
|
-
// },
|
|
28
|
-
// },
|
|
29
19
|
{
|
|
30
|
-
name:
|
|
31
|
-
platforms: [
|
|
20
|
+
name: '@electron-forge/maker-zip',
|
|
21
|
+
platforms: ['darwin'],
|
|
32
22
|
},
|
|
33
23
|
{
|
|
34
|
-
name:
|
|
24
|
+
name: '@electron-forge/maker-deb',
|
|
35
25
|
config: {},
|
|
36
26
|
},
|
|
37
27
|
{
|
|
38
|
-
name:
|
|
39
|
-
config: {
|
|
40
|
-
skipRpathValidation: true, // necessary to build the package on fedora
|
|
41
|
-
},
|
|
28
|
+
name: '@electron-forge/maker-rpm',
|
|
29
|
+
config: {},
|
|
42
30
|
},
|
|
43
31
|
],
|
|
44
32
|
plugins: [
|
|
45
33
|
{
|
|
46
|
-
name:
|
|
34
|
+
name: '@electron-forge/plugin-auto-unpack-natives',
|
|
47
35
|
config: {},
|
|
48
36
|
},
|
|
49
37
|
{
|
|
50
|
-
name:
|
|
38
|
+
name: '@electron-forge/plugin-webpack',
|
|
51
39
|
config: {
|
|
52
|
-
mainConfig:
|
|
40
|
+
mainConfig: './webpack.main.config.js',
|
|
53
41
|
renderer: {
|
|
54
|
-
config:
|
|
42
|
+
config: './webpack.renderer.config.js',
|
|
55
43
|
entryPoints: [
|
|
56
44
|
{
|
|
57
|
-
html:
|
|
58
|
-
js:
|
|
59
|
-
name:
|
|
45
|
+
html: './src/index.html',
|
|
46
|
+
js: './src/renderer.js',
|
|
47
|
+
name: 'main_window',
|
|
60
48
|
preload: {
|
|
61
|
-
js:
|
|
49
|
+
js: './src/preload.js',
|
|
62
50
|
},
|
|
63
51
|
},
|
|
64
52
|
],
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
package/ideas/Screenshot 2026-03-05 at 22-09-09 Packet Decoder Frontend /342/200/223 Figma Make.png
ADDED
|
Binary file
|
|
Binary file
|
package/ideas/ideas.txt
ADDED
|
@@ -0,0 +1,340 @@
|
|
|
1
|
+
FRAME (8 fields)
|
|
2
|
+
━
|
|
3
|
+
idx Packet index (0-based, displayed as 1-based)
|
|
4
|
+
ts Unix timestamp with microsecond precision (float)
|
|
5
|
+
time_str Formatted time HH:MM:SS.mmm (UTC)
|
|
6
|
+
date_str Formatted date YYYY-MM-DD (UTC)
|
|
7
|
+
orig_len Original packet length before any capture truncation
|
|
8
|
+
incl_len Captured (included) length stored in file
|
|
9
|
+
link_type PCAP link-layer type (1=Ethernet, 113=SLL, 101=RawIP)
|
|
10
|
+
inter_arrival Seconds since previous packet (0.0 for first packet)
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
14
|
+
ETHERNET (9 fields)
|
|
15
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
16
|
+
|
|
17
|
+
src_mac Source MAC address (xx:xx:xx:xx:xx:xx)
|
|
18
|
+
dst_mac Destination MAC address (xx:xx:xx:xx:xx:xx)
|
|
19
|
+
eth_type EtherType numeric value (int)
|
|
20
|
+
eth_type_str EtherType as hex string e.g. "0x0800"
|
|
21
|
+
vlan_id 802.1Q VLAN ID (0–4095), None if untagged
|
|
22
|
+
vlan_prio 802.1Q Priority Code Point (0–7), None if untagged
|
|
23
|
+
vlan_dei 802.1Q Drop Eligible Indicator (0 or 1), None if untagged
|
|
24
|
+
src_oui Vendor name from source MAC OUI prefix e.g. "VMware"
|
|
25
|
+
dst_oui Vendor name from destination MAC OUI prefix
|
|
26
|
+
|
|
27
|
+
|
|
28
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
29
|
+
IPv4 (15 fields)
|
|
30
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
31
|
+
|
|
32
|
+
ip_version IP version (4)
|
|
33
|
+
ip_ihl Internet Header Length in bytes (min 20)
|
|
34
|
+
ip_dscp Differentiated Services Code Point (6 bits, 0–63)
|
|
35
|
+
ip_ecn Explicit Congestion Notification (2 bits, 0–3)
|
|
36
|
+
ip_total_len Total IP datagram length including header
|
|
37
|
+
ip_id IP Identification field (fragmentation ID)
|
|
38
|
+
ip_flags Raw flags field (3 bits)
|
|
39
|
+
ip_flag_df Don't Fragment flag (True/False)
|
|
40
|
+
ip_flag_mf More Fragments flag (True/False)
|
|
41
|
+
ip_frag_offset Fragment offset in bytes (0 if not fragmented)
|
|
42
|
+
ttl Time To Live hop count
|
|
43
|
+
ip_proto IP protocol number (6=TCP, 17=UDP, 1=ICMP, etc.)
|
|
44
|
+
ip_proto_str Protocol name string e.g. "TCP", "UDP", "OSPF"
|
|
45
|
+
ip_checksum Header checksum (hex)
|
|
46
|
+
src_ip Source IP address (dotted decimal)
|
|
47
|
+
dst_ip Destination IP address (dotted decimal)
|
|
48
|
+
|
|
49
|
+
|
|
50
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
51
|
+
IPv6 (5 fields) [populated instead of IPv4 fields for IPv6 packets]
|
|
52
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
53
|
+
|
|
54
|
+
ipv6_tc Traffic Class byte (DSCP + ECN combined)
|
|
55
|
+
ipv6_flow Flow Label (20-bit value)
|
|
56
|
+
ipv6_plen Payload length (bytes after fixed 40-byte header)
|
|
57
|
+
ipv6_next Next Header type (same values as ip_proto)
|
|
58
|
+
ipv6_hoplimit Hop Limit (equivalent to IPv4 TTL)
|
|
59
|
+
|
|
60
|
+
Note: src_ip, dst_ip, ip_version, ip_dscp, ip_ecn, ttl, ip_proto,
|
|
61
|
+
ip_proto_str are also set for IPv6 packets.
|
|
62
|
+
|
|
63
|
+
|
|
64
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
65
|
+
TCP (15 fields)
|
|
66
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
67
|
+
|
|
68
|
+
src_port Source port number (0–65535)
|
|
69
|
+
dst_port Destination port number (0–65535)
|
|
70
|
+
tcp_seq Sequence number (32-bit)
|
|
71
|
+
tcp_ack_num Acknowledgment number (32-bit)
|
|
72
|
+
tcp_hdr_len TCP header length in bytes (20–60)
|
|
73
|
+
tcp_flags Human-readable flag string e.g. "SYN", "ACK|PSH"
|
|
74
|
+
tcp_flags_raw Raw flags byte (0x02 = SYN, 0x12 = ACK|SYN, etc.)
|
|
75
|
+
tcp_window Receive window size (bytes, before scaling)
|
|
76
|
+
tcp_checksum TCP checksum (hex)
|
|
77
|
+
tcp_urgent Urgent pointer value
|
|
78
|
+
tcp_mss Maximum Segment Size from options (if present)
|
|
79
|
+
tcp_wscale Window Scale factor from options (if present)
|
|
80
|
+
tcp_sack_perm SACK Permitted option present (True/None)
|
|
81
|
+
tcp_sack_blocks SACK block ranges as string e.g. "1000-2000,3000-4000"
|
|
82
|
+
tcp_ts_val TCP Timestamp value (if timestamp option present)
|
|
83
|
+
tcp_ts_ecr TCP Timestamp echo reply (if timestamp option present)
|
|
84
|
+
tcp_options_summary Human-readable summary of all TCP options
|
|
85
|
+
|
|
86
|
+
|
|
87
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
88
|
+
UDP (4 fields)
|
|
89
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
90
|
+
|
|
91
|
+
src_port Source port number
|
|
92
|
+
dst_port Destination port number
|
|
93
|
+
udp_len UDP datagram length including 8-byte header
|
|
94
|
+
udp_checksum UDP checksum (hex)
|
|
95
|
+
|
|
96
|
+
|
|
97
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
98
|
+
ICMP (8 fields)
|
|
99
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
100
|
+
|
|
101
|
+
icmp_type ICMP type number (0=Echo Reply, 8=Echo Request, etc.)
|
|
102
|
+
icmp_code ICMP code number (sub-type)
|
|
103
|
+
icmp_checksum ICMP checksum (hex)
|
|
104
|
+
icmp_id Echo identifier (Echo Request/Reply only)
|
|
105
|
+
icmp_seq Echo sequence number (Echo Request/Reply only)
|
|
106
|
+
icmp_type_str Human-readable type e.g. "Echo Request", "Time Exceeded"
|
|
107
|
+
icmp_code_str Human-readable code e.g. "Port Unreachable"
|
|
108
|
+
|
|
109
|
+
Supported ICMP types: Echo Reply (0), Dest Unreachable (3), Source Quench (4),
|
|
110
|
+
Redirect (5), Echo Request (8), Router Advert (9), Router Solicit (10),
|
|
111
|
+
Time Exceeded (11), Param Problem (12), Timestamp Req/Reply (13/14),
|
|
112
|
+
Address Mask Req/Reply (17/18)
|
|
113
|
+
|
|
114
|
+
Dest Unreachable codes: Net/Host/Proto/Port Unreachable, Frag Needed,
|
|
115
|
+
Src Route Failed, Net/Host/Comm Admin Prohibited
|
|
116
|
+
|
|
117
|
+
|
|
118
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
119
|
+
ICMPv6 (3 fields)
|
|
120
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
121
|
+
|
|
122
|
+
icmpv6_type ICMPv6 type number
|
|
123
|
+
icmpv6_code ICMPv6 code number
|
|
124
|
+
icmpv6_type_str Human-readable type e.g. "Neighbor Solicit", "Echo Reply"
|
|
125
|
+
|
|
126
|
+
Supported ICMPv6 types: Dest Unreach (1), Packet Too Big (2),
|
|
127
|
+
Time Exceeded (3), Echo Request/Reply (128/129), Router Solicit/Advert (133/134),
|
|
128
|
+
Neighbor Solicit/Advert (135/136), MLD Report (143)
|
|
129
|
+
|
|
130
|
+
|
|
131
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
132
|
+
ARP (10 fields)
|
|
133
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
134
|
+
|
|
135
|
+
arp_htype Hardware type (1 = Ethernet)
|
|
136
|
+
arp_ptype Protocol type (0x0800 = IPv4)
|
|
137
|
+
arp_hlen Hardware address length (6 for MAC)
|
|
138
|
+
arp_plen Protocol address length (4 for IPv4)
|
|
139
|
+
arp_op Operation code (1=Request, 2=Reply)
|
|
140
|
+
arp_op_str Operation string "Request" or "Reply"
|
|
141
|
+
arp_sha Sender hardware (MAC) address
|
|
142
|
+
arp_spa Sender protocol (IP) address
|
|
143
|
+
arp_tha Target hardware (MAC) address
|
|
144
|
+
arp_tpa Target protocol (IP) address
|
|
145
|
+
|
|
146
|
+
Note: src_ip/dst_ip/src_mac/dst_mac also set from ARP sender/target fields
|
|
147
|
+
|
|
148
|
+
|
|
149
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
150
|
+
DNS (14 fields) [UDP/TCP port 53]
|
|
151
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
152
|
+
|
|
153
|
+
dns_txid Transaction ID (16-bit hex)
|
|
154
|
+
dns_qr Query/Response flag (0=Query, 1=Response)
|
|
155
|
+
dns_opcode Opcode (0=Standard, 1=Inverse, 2=Status)
|
|
156
|
+
dns_aa Authoritative Answer bit (0/1)
|
|
157
|
+
dns_tc Truncation bit (0/1)
|
|
158
|
+
dns_rd Recursion Desired bit (0/1)
|
|
159
|
+
dns_ra Recursion Available bit (0/1)
|
|
160
|
+
dns_rcode Response code number
|
|
161
|
+
dns_rcode_str Response code string e.g. "NOERROR", "NXDOMAIN"
|
|
162
|
+
dns_qdcount Number of questions in the query section
|
|
163
|
+
dns_ancount Number of answer resource records
|
|
164
|
+
dns_nscount Number of authority resource records
|
|
165
|
+
dns_arcount Number of additional resource records
|
|
166
|
+
dns_queries Semicolon-separated query strings e.g. "google.com[A]"
|
|
167
|
+
dns_answers Semicolon-separated answer strings e.g. "google.com=142.250.80.46[TTL=300]"
|
|
168
|
+
|
|
169
|
+
Supported record types: A, NS, CNAME, SOA, PTR, MX, TXT, AAAA, SRV, ANY
|
|
170
|
+
Response codes: NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED
|
|
171
|
+
|
|
172
|
+
|
|
173
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
174
|
+
HTTP (10 fields) [TCP port 80, 8080, or payload signature]
|
|
175
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
176
|
+
|
|
177
|
+
http_method Request method e.g. "GET", "POST", "PUT", "DELETE"
|
|
178
|
+
http_uri Request URI / path e.g. "/index.html"
|
|
179
|
+
http_version HTTP version string e.g. "HTTP/1.1"
|
|
180
|
+
http_host Host header value
|
|
181
|
+
http_user_agent User-Agent header value
|
|
182
|
+
http_content_type Content-Type header value
|
|
183
|
+
http_content_len Content-Length header value (string)
|
|
184
|
+
http_status_code Response status code e.g. "200", "404"
|
|
185
|
+
http_status_msg Response status message e.g. "OK", "Not Found"
|
|
186
|
+
http_headers Semicolon-separated key:value pairs of all headers (up to 12)
|
|
187
|
+
|
|
188
|
+
Detected methods: GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH, CONNECT, TRACE
|
|
189
|
+
Also detects TLS ClientHello on port 443 → app_proto = "HTTPS"
|
|
190
|
+
|
|
191
|
+
|
|
192
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
193
|
+
DHCP (8 fields) [UDP ports 67/68]
|
|
194
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
195
|
+
|
|
196
|
+
dhcp_op Op code (1=BOOTREQUEST, 2=BOOTREPLY)
|
|
197
|
+
dhcp_xid Transaction ID (32-bit hex)
|
|
198
|
+
dhcp_ciaddr Client IP address (if known)
|
|
199
|
+
dhcp_yiaddr Your (client) IP address offered by server
|
|
200
|
+
dhcp_siaddr Next server IP address
|
|
201
|
+
dhcp_msg_type DHCP message type from option 53:
|
|
202
|
+
DISCOVER, OFFER, REQUEST, DECLINE, ACK, NAK,
|
|
203
|
+
RELEASE, INFORM
|
|
204
|
+
dhcp_hostname Client hostname from option 12
|
|
205
|
+
dhcp_requested_ip Requested IP from option 50
|
|
206
|
+
|
|
207
|
+
|
|
208
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
209
|
+
PAYLOAD (6 fields) [all protocols]
|
|
210
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
211
|
+
|
|
212
|
+
payload_len Payload byte count after transport header
|
|
213
|
+
payload_bytes Raw payload bytes (not exported to CSV)
|
|
214
|
+
payload_ascii Full payload rendered as ASCII, non-printable → '.'
|
|
215
|
+
(up to 1024 chars in fields view, 4096 in ASCII tab)
|
|
216
|
+
payload_printable_ratio Fraction of bytes in printable ASCII range (0x20–0x7e)
|
|
217
|
+
e.g. 0.95 = 95% printable (likely plaintext)
|
|
218
|
+
Note: \r \n count as non-printable (control chars)
|
|
219
|
+
payload_entropy Shannon entropy of first 256 payload bytes (0.0–8.0)
|
|
220
|
+
~0.0 = constant/repetitive data
|
|
221
|
+
~4–5 = mixed/structured text
|
|
222
|
+
~7–8 = encrypted, compressed, or random data
|
|
223
|
+
payload_hex_preview First 32 bytes as space-separated hex pairs
|
|
224
|
+
|
|
225
|
+
ASCII tab also extracts:
|
|
226
|
+
- All contiguous printable strings of 8+ characters from payload
|
|
227
|
+
- Up to 60 unique strings shown per packet, up to 120 bytes each
|
|
228
|
+
|
|
229
|
+
|
|
230
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
231
|
+
META (4 fields)
|
|
232
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
233
|
+
|
|
234
|
+
proto Transport-layer protocol string e.g. "TCP", "UDP", "ARP"
|
|
235
|
+
Overridden to app protocol when app is DNS, HTTP, DHCP
|
|
236
|
+
app_proto Application-layer protocol string e.g. "DNS", "HTTP",
|
|
237
|
+
"HTTPS", "DHCP", or "" if not detected
|
|
238
|
+
info Human-readable one-line summary for the packet list view
|
|
239
|
+
raw Complete raw packet bytes (not exported to CSV)
|
|
240
|
+
|
|
241
|
+
|
|
242
|
+
|
|
243
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
244
|
+
EXPORT FIELDS (CSV / TSV) — 80 columns
|
|
245
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
246
|
+
|
|
247
|
+
idx, date, time, proto, app_proto,
|
|
248
|
+
src_mac, src_oui, dst_mac, dst_oui, vlan_id, eth_type_str,
|
|
249
|
+
src_ip, dst_ip, ip_version, ip_ihl, ip_dscp, ip_ecn,
|
|
250
|
+
ip_total_len, ip_id, ip_flag_df, ip_flag_mf, ip_frag_offset,
|
|
251
|
+
ttl, ip_proto_str, ip_checksum,
|
|
252
|
+
ipv6_tc, ipv6_flow, ipv6_hoplimit,
|
|
253
|
+
src_port, dst_port,
|
|
254
|
+
tcp_seq, tcp_ack_num, tcp_hdr_len, tcp_flags, tcp_window,
|
|
255
|
+
tcp_checksum, tcp_urgent, tcp_mss, tcp_wscale, tcp_sack_perm,
|
|
256
|
+
tcp_ts_val, tcp_ts_ecr, tcp_options_summary,
|
|
257
|
+
udp_len, udp_checksum,
|
|
258
|
+
icmp_type, icmp_code, icmp_type_str, icmp_code_str, icmp_id, icmp_seq,
|
|
259
|
+
icmpv6_type, icmpv6_type_str,
|
|
260
|
+
arp_op_str, arp_sha, arp_spa, arp_tha, arp_tpa,
|
|
261
|
+
dns_txid, dns_qr, dns_rcode_str, dns_qdcount, dns_ancount,
|
|
262
|
+
dns_queries, dns_answers,
|
|
263
|
+
http_method, http_uri, http_version, http_host,
|
|
264
|
+
http_user_agent, http_content_type, http_content_len,
|
|
265
|
+
http_status_code, http_status_msg,
|
|
266
|
+
dhcp_msg_type, dhcp_hostname, dhcp_yiaddr, dhcp_requested_ip,
|
|
267
|
+
payload_len, payload_printable_ratio, payload_entropy,
|
|
268
|
+
payload_hex_preview, payload_ascii (truncated to 256 chars),
|
|
269
|
+
orig_len, incl_len, inter_arrival
|
|
270
|
+
|
|
271
|
+
Note: payload_bytes and raw are excluded from export (binary data)
|
|
272
|
+
|
|
273
|
+
|
|
274
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
275
|
+
OUI VENDOR DATABASE (partial — top vendors)
|
|
276
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
277
|
+
|
|
278
|
+
00:00:0c Cisco 00:50:56 VMware 00:0c:29 VMware
|
|
279
|
+
00:1a:a0 Dell b8:27:eb Raspberry Pi dc:a6:32 Raspberry Pi
|
|
280
|
+
00:1b:21 Intel 00:23:14 Intel 3c:97:0e Apple
|
|
281
|
+
a4:c3:f0 Apple 00:17:f2 Apple fc:fb:fb Cisco
|
|
282
|
+
00:50:43 3Com 00:e0:4c Realtek 52:54:00 QEMU/KVM
|
|
283
|
+
00:15:5d Microsoft(Hyp-V) 00:03:ff Microsoft
|
|
284
|
+
00:1c:42 Parallels 08:00:27 VirtualBox
|
|
285
|
+
|
|
286
|
+
|
|
287
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
288
|
+
WELL-KNOWN PORT NAMES (service resolution)
|
|
289
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
290
|
+
|
|
291
|
+
20 FTP-data 21 FTP 22 SSH 23 Telnet
|
|
292
|
+
25 SMTP 53 DNS 67 DHCP-srv 68 DHCP-cli
|
|
293
|
+
69 TFTP 80 HTTP 110 POP3 119 NNTP
|
|
294
|
+
123 NTP 135 MSRPC 137 NetBIOS-NS 138 NetBIOS-DG
|
|
295
|
+
139 NetBIOS-SS 143 IMAP 161 SNMP 162 SNMP-trap
|
|
296
|
+
389 LDAP 443 HTTPS 445 SMB 465 SMTPS
|
|
297
|
+
500 IKE 514 Syslog 515 LPD 587 SMTP-sub
|
|
298
|
+
636 LDAPS 993 IMAPS 995 POP3S 1080 SOCKS
|
|
299
|
+
1194 OpenVPN 1433 MSSQL 1521 Oracle 1723 PPTP
|
|
300
|
+
3306 MySQL 3389 RDP 4444 Metasploit 5060 SIP
|
|
301
|
+
5061 SIPS 5432 PostgreSQL 5900 VNC 6379 Redis
|
|
302
|
+
6881 BitTorrent 8080 HTTP-alt 8443 HTTPS-alt 9200 Elasticsearch
|
|
303
|
+
27017 MongoDB
|
|
304
|
+
|
|
305
|
+
|
|
306
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
307
|
+
SUPPORTED LINK TYPES
|
|
308
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
309
|
+
|
|
310
|
+
1 Ethernet (IEEE 802.3)
|
|
311
|
+
12 Raw IPv4
|
|
312
|
+
101 Raw IPv4 (alternate)
|
|
313
|
+
113 Linux cooked capture (SLL)
|
|
314
|
+
|
|
315
|
+
Both little-endian and big-endian PCAP files are supported.
|
|
316
|
+
PCAP-NG format is not supported — save as legacy .pcap first.
|
|
317
|
+
|
|
318
|
+
|
|
319
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
320
|
+
FIELD COUNT SUMMARY
|
|
321
|
+
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
322
|
+
|
|
323
|
+
Layer Fields
|
|
324
|
+
─────────────────────────
|
|
325
|
+
Frame 8
|
|
326
|
+
Ethernet 9
|
|
327
|
+
IPv4 15
|
|
328
|
+
IPv6 5
|
|
329
|
+
TCP 17 (incl. options: MSS, WS, SACK, timestamps)
|
|
330
|
+
UDP 4
|
|
331
|
+
ICMP 7
|
|
332
|
+
ICMPv6 3
|
|
333
|
+
ARP 10
|
|
334
|
+
DNS 14
|
|
335
|
+
HTTP 10
|
|
336
|
+
DHCP 8
|
|
337
|
+
Payload 6
|
|
338
|
+
Meta 4
|
|
339
|
+
─────────────────────────
|
|
340
|
+
TOTAL 120
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
package/logo/ps-icon.ico
ADDED
|
Binary file
|
|
Binary file
|
|
Binary file
|
package/logo/qr-code.png
ADDED
|
Binary file
|
|
Binary file
|
package/package.json
CHANGED
|
@@ -2,14 +2,14 @@
|
|
|
2
2
|
"name": "packetsnitch",
|
|
3
3
|
"executableName": "packetsnitch",
|
|
4
4
|
"productName": "packetsnitch",
|
|
5
|
-
"version": "1.5.
|
|
5
|
+
"version": "1.5.606",
|
|
6
6
|
"description": "A High Level Network Analysis Tool",
|
|
7
7
|
"main": ".webpack/main",
|
|
8
8
|
"private": false,
|
|
9
9
|
"scripts": {
|
|
10
10
|
"start": "electron-forge start",
|
|
11
11
|
"package": "npm run build-python && electron-forge package",
|
|
12
|
-
"make": "npm run build-python && QA_SKIP_RPATHS=1 electron-forge make",
|
|
12
|
+
"make": "npm run build-python && cp spec.ejs node_modules/electron-installer-redhat/resources/spec.ejs && QA_SKIP_RPATHS=1 electron-forge make",
|
|
13
13
|
"build-python": "python3 -m PyInstaller --onedir -y --add-data \"backend/common:common\" --distpath backend ./backend/snitch.py",
|
|
14
14
|
"publish": "QA_SKIP_RPATHS=1 electron-forge publish"
|
|
15
15
|
},
|
|
@@ -51,7 +51,6 @@
|
|
|
51
51
|
"devDependencies": {
|
|
52
52
|
"@electron-forge/cli": "^7.11.1",
|
|
53
53
|
"@electron-forge/maker-deb": "^7.11.1",
|
|
54
|
-
"@electron-forge/maker-flatpak": "^7.11.2",
|
|
55
54
|
"@electron-forge/maker-rpm": "^7.11.2",
|
|
56
55
|
"@electron-forge/maker-squirrel": "^7.11.1",
|
|
57
56
|
"@electron-forge/maker-zip": "^7.11.1",
|