[{"_1":2,"_161":-5,"_162":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_129":-5,"_130":11,"_131":21,"_132":11,"_133":-5,"_134":11,"_135":-5,"_136":137,"_138":91,"_139":-7},"canonicalUrl","https://hub.docker.com/r/imfht/tcppc_yujie/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","imfht","reponame","tcppc_yujie","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2021-07-01T07:12:02.864235Z","description","yujie","is_private","last_updated","2021-07-15T07:59:10.687381Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",257,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# tcppc\n\n`tcppc` is a simple honeypot program to capture TCP/TLS/UDP payloads. This\nprogram listens on the given IP address and the given port, establishes\nconnections from external hosts, and continues to receive packets until the\nconnections are closed or timeouted. `tcppc` supports transparent proxy\n(TPROXY) by iptables, so you can get payloads of arbitrary ports using `tcppc`.\nI am developing this program to use as a honeypot for monitoring payloads.\n\nMain functions:\n\n* Establish TCP or TLS handshake and continue to receive packets.\n* Receive UDP packets.\n* Support transparent proxy (PROXY) to listen on all ports.\n* Save received data (session data) as JSON lines format.\n* Rotate the data files in the given interval.\n\n\n## Installation\n\n### Precompiled binary\n\nPrecompiled binaries for Linux (x86_64) are released.\nSee [release](https://github.com/md-irohas/tcppc-go/releases) page.\n\n### Compile from source\n\n`tcppc` is written in Go. So, if you want to build its binary, you need to\nprepare the development environment for Go.\n\nIf you are ready for building Go, type the following commands.\n\n```sh\n$ go get github.com/md-irohas/tcppc-go\n```\n\nNote that the version of go compiler must be 1.11.0 or newer to enable timeout\nof connection.\n\n\n## Usage\n\nThe followings are the options of `tcppc`.\nYou can also use configuration files instead of using these options (See\n'Configuration' section).\n\n```sh\nUsage of ./tcppc-go:\n -C string\n TLS certificate file.\n -H string\n hostname to listen on. (default \"0.0.0.0\")\n -K string\n TLS key file.\n -L string\n [deprecated] log file.\n -R uint\n maximum number of file descriptors (need root priviledge).\n -T int\n rotation interval [sec].\n -c string\n configuration file.\n -disable-tcp-server\n disable TCP/TLS server.\n -disable-udp-server\n disable UDP server.\n -offset int\n rotation interval offset [sec].\n -p int\n port number to listen on. (default 12345)\n -t int\n timeout for TCP/TLS connection. (default 60)\n -v show version and exit.\n -w string\n session file (JSON lines format).\n -z string\n timezone used for session file. (default \"Local\")\n```\n\n\n### Example-1: Basics\n\nRun tcppc-go program.\n\n```sh\n$ sudo ./tcppc-go\n2019/04/16 23:42:32 Maximum number of file descriptors: 1024\n2019/04/16 23:42:32 Timezone: Local\n2019/04/16 23:42:32 Timeout: 60\n2019/04/16 23:42:32 Session data file: none.\n2019/04/16 23:42:32 !!!CAUTION!!! Session data will not be written to files.\n2019/04/16 23:42:32 Server Mode: TCP\n2019/04/16 23:42:32 Listen: 0.0.0.0:12345\n2019/04/16 23:42:32 Start TCP server.\n2019/04/16 23:42:32 Server Mode: UDP\n2019/04/16 23:42:32 Listen: 0.0.0.0:12345\n2019/04/16 23:42:32 Start UDP server.\n```\n\nConnect to the server from another terminal.\n\n```sh\n$ echo \"Hello, TCPPC\" | nc 127.0.0.1 12345\n```\n\nThe tcppc-go gets the following logs.\n\n```sh\n$ ./tcppc-go\n...\n2019/04/16 23:44:00 TCP: Established: Session: 2019-04-16T23:44:00: Flow: tcp 127.0.0.1:60998 <-> 127.0.0.1:12345 (0 payloads) (#Sessions: 1)\n2019/04/16 23:44:00 TCP: Received: Session: 2019-04-16T23:44:00: Flow: tcp 127.0.0.1:60998 <-> 127.0.0.1:12345 (1 payloads): \"Hello, TCPPC\\n\" (13 bytes)\n2019/04/16 23:44:00 Closed: Session: 2019-04-16T23:44:00: Flow: tcp 127.0.0.1:60998 <-> 127.0.0.1:12345 (1 payloads) (#Sessions: 1)\n```\n\nSend UDP packets from the terminal.\n\n```sh\n$ echo \"Hello, TCPPC\" | nc -u 127.0.0.1 12345\n```\n\nThe tcppc-go gets the following logs.\n\n```sh\n...\n2019/04/16 23:45:20 UDP: Received: Session: 2019-04-16T23:45:20: Flow: udp 127.0.0.1:49616 <-> 127.0.0.1:12345 (1 payloads): \"Hello, TCPPC\\n\" (13 bytes)\n```\n\nType Ctrl+C to stop this program.\n\n### Example-2: Save session data\n\nYou can save session data to files as [JSON lines](http://jsonlines.org/) format.\n\nWhen `-w` option is specified, the data will be written to the given file.\nYou can use datetime format in `-w` option (See `man strftime` for more\ndetails). When `-T` option is specified, data files will be rotated every\ngiven seconds.\n\nRun tcppc-go program.\n\n```sh\n$ ./tcppc-go -T 86400 -w log/tcppc-%Y%m%d.jsonl\n```\n\nConnect to the server from another terminal.\n\n```sh\n$ echo \"Hello, TCPPC\" | nc 127.0.0.1 12345\n```\n\nThe results of the data are the following.\nNote that data in payloads are encoded in base64.\n\n```sh\n# jq is a command for formatting JSON.\n# I tested this on April 18th, 2018.\n\n$ jq . log/tcppc-20180418.jsonl\n{\n \"timestamp\": \"2018-04-18T09:51:34.689896842+09:00\",\n \"flow\": {\n \"proto\": \"tcp\",\n \"src\": \"127.0.0.1\",\n \"sport\": 53484,\n \"dst\": \"127.0.0.1\",\n \"dport\": 12345\n },\n \"payloads\": [\n {\n \"index\": 0,\n \"timestamp\": \"2018-04-18T09:51:34.690076698+09:00\",\n \"data\": \"SGVsbG8sIFRDUFBDCg==\"\n }\n ]\n}\n```\n\n### Example-3: TLS handshaker\n\n`tcppc` supports not only TCP handshake but also TLS handshake.\n\nWhen both `-C` and `-K` options are specified, this program works as TLS\nhandshaker. You need to prepare for TLS certificate (in many cases,\nself-signed) and key files (See 'Configuration' section).\n\nRun tcppc-go program.\n\n```sh\n$ ./tcppc-go -T 86400 -C server.crt -K server.key -w log/tcppc-%Y%m%d.jsonl\n```\n\nConnect to the server from another terminal.\n\n```sh\n$ wget --no-check-certificate https://127.0.0.1:12345/index\n```\n\nThe results of session data are the following (formatted by `jq` command).\n\n```sh\n$ jq . log/tcppc-20180418.jsonl\n{\n \"timestamp\": \"2018-04-18T10:06:08.104667676+09:00\",\n \"flow\": {\n \"proto\": \"tls\",\n \"src\": \"127.0.0.1\",\n \"sport\": 53635,\n \"dst\": \"127.0.0.1\",\n \"dport\": 12345\n },\n \"payloads\": [\n {\n \"index\": 0,\n \"timestamp\": \"2018-04-18T10:06:08.111138967+09:00\",\n \"data\": \"R0VUIC9pbmRleCBIVFRQLzEuMQ0KVXNlci1BZ2VudDogV2dldC8xLjE5LjIgKGRhcndpbjE3LjMuMCkNCkFjY2VwdDogKi8qDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANCkhvc3Q6IDEyNy4wLjAuMToxMjM0NQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KDQo=\"\n }\n ]\n}\n\n# decode \"data\" as base64.\n$ echo \"R0VUIC9pbmRleCBIVFRQLzEuMQ0KVXNlci1BZ2VudDogV2dldC8xLjE5LjIgKGRhcndpbjE3LjMuMCkNCkFjY2VwdDogKi8qDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXANCkhvc3Q6IDEyNy4wLjAuMToxMjM0NQ0KQ29ubmVjdGlvbjogS2VlcC1BbGl2ZQ0KDQo=\" | base64 -D\nGET /index HTTP/1.1\nUser-Agent: Wget/1.19.2 (darwin17.3.0)\nAccept: */*\nAccept-Encoding: gzip\nHost: 127.0.0.1:12345\nConnection: Keep-Alive\n\n```\n\n\n## Configuration\n\n### Configuration file\n\nThe template of configuration file in [TOML](https://github.com/toml-lang/toml) format is ready.\nSee tcppc.toml.orig.\n\n```sh\n$ cp tcppc.toml.orig /etc/tcppc.toml\n$ vim /etc/tcppc.toml\n\n... (edit) ...\n```\n\n### TLS certificate/key files\n\nIf you want to use `tcppc` as TLS handshaker, you need to prepare TLS\ncertificate file and TLS key file.\n\nYou can create these files by the following commands.\n\n```sh\n$ openssl genrsa 2048 > server.key\n$ openssl req -new -key server.key > server.csr\n$ openssl x509 -days 36500 -req -signkey server.key < server.csr > server.crt\n```\n\nNote that these commands create not a valid certificate file but a\nself-signed certificate file.\n\n### Systemd\n\nA simple unit file of systemd is ready (`tcppc.service.orig`)\nEdit it and enable/start `tcppc` service.\n\n```sh\n# copy this file to systemd's directory.\ncp -v tcppc.service.orig /etc/systemd/system/\n\n# edit this file.\nvim /etc/systemd/system/tcppc.service\n\n# reload unit files.\nsystemctl daemon-reload\n\n# start tcppc service.\nsystemctl start tcppc\n\n# (optional) autostart tcppc service\nsystemctl enable tcppc\n```\n\n### Listen on all ports\n\nThe easiest way to listen on all ports is to use TPROXY function of `iptables`.\n\nIn this case, you should prepare a new (pseudo) network interface and an IP\naddress (i.e. IP alias) to monitor and capture all the traffic.\n\n```sh\n# !!! DANGER !!!\n$ iptables -t mangle -A PREROUTING -i -p tcp -d -j TPROXY --tproxy-mark 0x1/0x1 --on-ip --on-port 12345\n ace> -p tcp -d -j TPROXY --tproxy-mark 0x1/0x1 --on-ip --on-port 12345\n ace> -p tcp -d -j TPROXY --tproxy-mark 0x1/0x1 --on-ip --on-port 12345\n$ iptables -t mangle -A PREROUTING -i -p udp -d -j TPROXY --tproxy-mark 0x1/0x1 --on-ip --on-port 12345\n```\n\n\n## Session data format\n\nSession data file is [JSON Lines](http://jsonlines.org/) format (i.e. each\nline holds a JSON string.)\nEach line represents each session data.\n\nThe following shows the data example with some comments.\n\n```\n{\n // Time when the session is accepted.\n // i.e.\n // tcp/tls: time when the handshake is finished.\n // udp: time when the UDP packet is received.\n \"timestamp\": \"2018-04-18T11:06:09.419437117+09:00\",\n\n // Flow (protocol (i.e., tcp/tls/udp, source IP address, source port, local address, local port)\n \"flow\": {\n \"proto\": \"tcp\",\n \"src\": \"127.0.0.1\",\n \"sport\": 54167,\n \"dst\": \"127.0.0.1\",\n \"dport\": 12345\n },\n\n // List of payloads\n \"payloads\": [\n {\n // Index of payloads\n \"index\": 0,\n\n // Time when this payload was received.\n \"timestamp\": \"2018-04-18T11:06:13.830444868+09:00\",\n\n // Data encoded in base64\n \"data\": \"Rmlyc3QgcGF5bG9hZAo=\"\n },\n {\n \"index\": 1,\n \"timestamp\": \"2018-04-18T11:06:18.015019663+09:00\",\n \"data\": \"U2Vjb25kIHBheWxvYWQK\"\n }\n ]\n}\n```\n\n\n## Alternatives\n\nYou might be able to use `nc` or `socat` instead.\n\n\n## License\n\nMIT License ([link](https://opensource.org/licenses/MIT)).\n\n\n## Contact\n\nmd (E-mail: md.irohas at gmail.com)\n\n\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",332460028,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},"content_type","creator",3871621,"full_size",160878233,"id",156491319,"images",[101],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},"architecture","amd64","digest","sha256:80f8ada6130d7fe01de83479b65ec39f5e92db86aae385d31dae9dba7eb89f93","features","","last_pulled","2026-10-14T00:23:11.870526281Z","last_pushed","2021-07-15T07:59:11Z","os","linux","os_features","os_version","size","variant","2021-07-15T07:59:10.391757Z","last_updater","last_updater_username","media_type","latest","repository",14795191,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":142,"_149":150,"_136":159,"_160":11},{"_40":143,"_42":144,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":145,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":146,"_79":11,"_80":148,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":147},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_151":64,"_152":-5,"_153":-5,"_154":155},"count","next","previous","results",[156],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":157,"_50":118,"_119":94,"_120":33,"_121":56,"_57":122,"_123":124,"_125":109,"_126":118,"_127":66,"_128":21},[158],{"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":96,"_63":66,"_117":-5},[],"canDeleteTags","actionData","errors"]

imfht/tcppc_yujie

Tags for imfht/tcppc_yujie