webui

package
v0.16.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 11, 2026 License: BSD-3-Clause, GPL-3.0 Imports: 99 Imported by: 0

README

Netcap Web UI

A web-based user interface for exploring Netcap packet capture data in real-time.

For comprehensive documentation of the frontend tech stack, architecture, and development workflow, see docs/frontend.md.

Quick Start

Start a capture with the -http flag to enable the web interface:

# Process a PCAP file with web UI
net capture -read traffic.pcap -out output -http localhost:8080

# Process multiple files
net capture -read "*.pcap" -out output -http localhost:8080

The web UI will be available at http://localhost:8080. After processing completes, the server continues running so you can explore the results. Press Ctrl+C to stop.

Building

# Build the frontend (requires Node.js 18+ and pnpm)
cd frontend
pnpm install
pnpm build

# Then build the Go binary (from repo root)
go build -o net ./cmd/net/

The frontend is built with Vite and output to frontend/dist/, which is embedded into the Go binary via //go:embed.

Development

# Start the frontend dev server with hot reload
cd frontend
pnpm dev

# In another terminal, start the Go backend
net capture -read traffic.pcap -out output -http localhost:8080

The Vite dev server runs at http://localhost:5173 and proxies /api/* to the Go backend at localhost:8080.

Architecture

  • Backend: Go HTTP server with REST API, gzip compression, and CORS support
  • Frontend: React 19 SPA with Vite, React Router 7, MUI 7, and SWR
  • Embedding: Frontend dist/ is embedded in the Go binary with SPA fallback routing

API Endpoints

The backend exposes 80+ REST endpoints. Key categories:

  • /api/status — Capture status and metadata
  • /api/files/* — Input files, audit files, logs
  • /api/hosts, /api/connections, /api/services — Network data
  • /api/certificates, /api/fingerprints — TLS analysis
  • /api/rules, /api/alerts — Detection and alerting
  • /api/chart/*, /api/visualize/* — Charting data

See server.go for the complete route list.

Documentation

Index

Constants

View Source 
const BehaviorHealthName = behavior.HealthFilename
View Source 
const BehaviorSnapshotName = "Behavior.json"
View Source 
const EnvMCPAdminToken = "NETCAP_MCP_ADMIN_TOKEN"

EnvMCPAdminToken is the env-var name that gates the /mcp endpoint in service mode. When unset (or empty), /mcp is not mounted at all and HTTP requests to it return 404. Operators of try.netcap.io set this to enable admin-only MCP access.

View Source 
const NetworkDetectionSnapshotName = networkdetect.StatsFilename

Variables

View Source 
var EmbeddedAssets embed.FS

The "all:" prefix includes dotfiles. Build the frontend before compiling.

View Source 
var ErrAuditRecordTypeMismatch = errors.New("audit record type mismatch")

ErrAuditRecordTypeMismatch indicates that a decoded record is not the requested type.

Functions

func CountRecords 

func CountRecords(filePath string) int64

CountRecords counts the number of records in an audit file

func CountRecordsWithCommunityIDFilter 

func CountRecordsWithCommunityIDFilter(filePath string, communityIDs map[string]bool) int64

CountRecordsWithCommunityIDFilter counts records that match any of the given community IDs

func CountUniqueCertificates 

func CountUniqueCertificates(outDir string) int64

CountUniqueCertificates counts deduplicated certificates by SHA256 fingerprint. This matches the deduplication logic used by readCertificates / the certificates table.

func CountUniqueCertificatesWithCommunityIDFilter 

func CountUniqueCertificatesWithCommunityIDFilter(outDir string, communityIDs map[string]bool) int64

CountUniqueCertificatesWithCommunityIDFilter counts deduplicated certificates that match any of the given community IDs.

func GetLayerName 

func GetLayerName(layer LayerType) string

GetLayerName returns a human-readable name for the layer type

func GetServerStartTime 

func GetServerStartTime() time.Time

GetServerStartTime returns the time when the server was started

func GetTypeValue 

func GetTypeValue(name string) (int32, bool)

GetTypeValue checks if a decoder name has a corresponding type value

func HandleAuditFieldValues 

func HandleAuditFieldValues(w http.ResponseWriter, r *http.Request, filePath, recordTypeName string)

HandleAuditFieldValues returns sample values for fields in a specific audit record type

func HandleAuditFields 

func HandleAuditFields(w http.ResponseWriter, r *http.Request, recordTypeName string)

HandleAuditFields returns field information for a specific audit record type

func HandleAuditFiles 

func HandleAuditFiles(outputDir string) http.HandlerFunc

HandleAuditFiles returns list of audit record files for a given output directory

func HandleAuditFilesFiltered 

func HandleAuditFilesFiltered(outputDir string) http.HandlerFunc

HandleAuditFilesFiltered returns list of audit record files with counts filtered by community IDs

func HandleAuditMeta 

func HandleAuditMeta(w http.ResponseWriter, r *http.Request, filePath, auditType string)

HandleAuditMeta returns metadata for an audit file

func HandleAuditRecords 

func HandleAuditRecords(outputDir string) http.HandlerFunc

HandleAuditRecords streams audit records from a file

func HandleAuditStats 

func HandleAuditStats(outputDir string) http.HandlerFunc

HandleAuditStats returns statistics for specific audit record types

func HandleAuditStream 

func HandleAuditStream(w http.ResponseWriter, r *http.Request, filePath, auditType string)

HandleAuditStream streams audit records via Server-Sent Events

func HandleChartData 

func HandleChartData(outDir string) http.HandlerFunc

HandleChartData returns a handler that generates charts for a specific output directory (for service mode)

func HandleChartFields 

func HandleChartFields(outDir string) http.HandlerFunc

HandleChartFields returns a handler that returns available fields for a specific output directory (for service mode)

func HandleLogContent 

func HandleLogContent(outputDir string) http.HandlerFunc

HandleLogContent returns the content of a log file

func HandleLogFiles 

func HandleLogFiles(outputDir string) http.HandlerFunc

HandleLogFiles returns list of log files for a given output directory

func HandleProtocolHierarchy 

func HandleProtocolHierarchy(outDir string) http.HandlerFunc

HandleProtocolHierarchy is an exported handler factory for service mode

func HandleVisualizeBar3D 

func HandleVisualizeBar3D(outDir string) http.HandlerFunc

HandleVisualizeBar3D is an exported handler factory for service mode

func HandleVisualizeGeo 

func HandleVisualizeGeo(outDir string) http.HandlerFunc

HandleVisualizeGeo is an exported handler factory for service mode

func HandleVisualizeGeoAll 

func HandleVisualizeGeoAll() http.HandlerFunc

HandleVisualizeGeoAll is an exported handler factory for service mode

func HandleVisualizeGraph 

func HandleVisualizeGraph(outDir string) http.HandlerFunc

HandleVisualizeGraph is an exported handler factory for service mode

func HandleVisualizeHostsGraph 

func HandleVisualizeHostsGraph(outDir string) http.HandlerFunc

HandleVisualizeHostsGraph is an exported handler factory for service mode

func HandleVisualizeSankey 

func HandleVisualizeSankey(outDir string) http.HandlerFunc

HandleVisualizeSankey is an exported handler factory for service mode

func HandleVisualizeScatter3D 

func HandleVisualizeScatter3D(outDir string) http.HandlerFunc

HandleVisualizeScatter3D is an exported handler factory for service mode

func HandleVisualizeTreemap 

func HandleVisualizeTreemap(outDir string) http.HandlerFunc

HandleVisualizeTreemap is an exported handler factory for service mode

func InitRecordForDecoder 

func InitRecordForDecoder(decoderName string) any

InitRecordForDecoder initializes an audit record for the given decoder name

func RecordInjectionEvent 

func RecordInjectionEvent(ruleName, ruleAction, recordType, srcIP, dstIP string, srcPort, dstPort int, result string, err error, actionData map[string]any)

RecordInjectionEvent records an injection event (called from the injection engine)

func RespondJSON 

func RespondJSON(w http.ResponseWriter, status int, data any)

RespondJSON writes a JSON response with the given status code and data

func SetProductionHelperIdentity added in v0.15.4 

func SetProductionHelperIdentity(version, revision string)

SetProductionHelperIdentity scopes strict packaged-helper lookup to Pro. Call once during startup, before starting the server. Empty identity fails closed.

func SortAuditFiles 

func SortAuditFiles(files []AuditFileInfo)

SortAuditFiles sorts audit files hierarchically by layer type Link → Network → Transport → Application → Stream → Abstract → Unknown

func ValidateBehaviorHealth added in v0.15.4 

func ValidateBehaviorHealth(path string) error

func ValidateBehaviorSnapshot added in v0.15.4 

func ValidateBehaviorSnapshot(path string) error

ValidateBehaviorSnapshot preserves the module's format boundary for desktop consumers.

func ValidateNetworkDetectionSnapshot added in v0.15.4 

func ValidateNetworkDetectionSnapshot(path string) error

Types

type AggregatedError 

type AggregatedError struct {
	ErrorMessage string `json:"errorMessage"`
	Count        int    `json:"count"`
	FirstSeen    string `json:"firstSeen"`
}

AggregatedError represents an error message with its occurrence count

type AlertResponse 

type AlertResponse struct {
	SrcPort             string   `json:"srcPort,omitempty"`
	DstPort             string   `json:"dstPort,omitempty"`
	Domain              string   `json:"domain,omitempty"`
	Timestamp           int64    `json:"timestamp"`
	Name                string   `json:"name"`
	Description         string   `json:"description"`
	RuleName            string   `json:"ruleName"`
	RecordType          string   `json:"recordType"`
	Severity            string   `json:"severity"`
	Tags                []string `json:"tags"`
	MITRE               string   `json:"mitre"`
	SrcIP               string   `json:"srcIP"`
	DstIP               string   `json:"dstIP"`
	MatchedRecord       string   `json:"matchedRecord"`
	RuleExpression      string   `json:"ruleExpression"`
	Threshold           int32    `json:"threshold"`
	ThresholdWindow     int32    `json:"thresholdWindow"`
	Resolved            bool     `json:"resolved"`
	ResolvedAt          int64    `json:"resolvedAt,omitempty"`
	AlertID             string   `json:"alertId"` // Unique identifier for the alert
	TimestampNs         string   `json:"timestampNs,omitempty"`
	DetectedAtNs        string   `json:"detectedAtNs,omitempty"`
	TimestampBasis      string   `json:"timestampBasis,omitempty"`
	RuleDigest          string   `json:"ruleDigest,omitempty"`
	MatchedRecordSHA256 string   `json:"matchedRecordSHA256,omitempty"`

	GroupedEvaluation *rules.OfflineAlertMetadata `json:"groupedEvaluation,omitempty"`
}

AlertResponse represents an alert for the API

type AlertsResponse 

type AlertsResponse struct {
	Alerts     []AlertResponse `json:"alerts"`
	TotalCount int             `json:"totalCount"`
}

AlertsResponse represents the response containing multiple alerts

type AnalysisJob 

type AnalysisJob struct {
	ArtifactConfig []byte

	SessionID       string
	InputFile       string
	OutputDir       string
	EnableDPI       bool
	BPFFilter       string // BPF filter to apply during capture
	IncludeDecoders string // Decoders to include
	ExcludeDecoders string // Decoders to exclude
	// contains filtered or unexported fields
}

AnalysisJob represents a job in the analysis queue (service mode only)

type AuditFileInfo 

type AuditFileInfo struct {
	FileInfo
	Type        string `json:"type"`
	RecordCount int64  `json:"recordCount,omitempty"`
	Layer       string `json:"layer"`
}

AuditFileInfo extends FileInfo with audit record specific metadata

func ListAuditFiles 

func ListAuditFiles(outputDir string) ([]AuditFileInfo, error)

ListAuditFiles returns a list of audit files in the given directory

type AuditRecordReader 

type AuditRecordReader struct {
	// contains filtered or unexported fields
}

AuditRecordReader reads audit records from .ncap files

func NewAuditRecordReader 

func NewAuditRecordReader(filePath string) (*AuditRecordReader, error)

NewAuditRecordReader creates a new audit record reader

func (*AuditRecordReader) Close 

func (r *AuditRecordReader) Close() error

Close closes the reader and underlying file

func (*AuditRecordReader) DecodeRecord added in v0.15.4 

func (r *AuditRecordReader) DecodeRecord(raw []byte) (proto.Message, error)

DecodeRecord must run before the next NextRaw call reuses the input buffer.

func (*AuditRecordReader) NextAs added in v0.15.4 

func (r *AuditRecordReader) NextAs[T proto.Message]() (T, error)

NextAs reads a header-selected record and asserts its type, consuming it even on mismatch.

func (*AuditRecordReader) NextAsJSON 

func (r *AuditRecordReader) NextAsJSON() (string, error)

NextAsJSON reads the next audit record and returns it as JSON

func (*AuditRecordReader) NextRaw added in v0.15.4 

func (r *AuditRecordReader) NextRaw() ([]byte, error)

func (*AuditRecordReader) NextRecord 

func (r *AuditRecordReader) NextRecord() (proto.Message, error)

NextRecord reads the next audit record as a proto.Message The caller needs to type assert to the appropriate type

func (*AuditRecordReader) ReadHeader 

func (r *AuditRecordReader) ReadHeader() (*types.Header, error)

ReadHeader reads the audit record file header

func (*AuditRecordReader) Skip 

func (r *AuditRecordReader) Skip(n int) error

Skip skips n records from the current position

type AuditStatsResponse 

type AuditStatsResponse struct {
	TotalRecords       int64 `json:"totalRecords"`
	ExploitCount       int64 `json:"exploitCount"`
	VulnerabilityCount int64 `json:"vulnerabilityCount"`
	SecretCount        int64 `json:"secretCount"`
	SoftwareCount      int64 `json:"softwareCount"`
}

AuditStatsResponse represents the audit record statistics response

type AuthActivityEvent 

type AuthActivityEvent struct {
	Timestamp int64  `json:"timestamp"`
	Protocol  string `json:"protocol"` // "Credentials", "TACACS", "Kerberos"
	User      string `json:"user"`
	Service   string `json:"service"`
	Action    string `json:"action"`
	Status    string `json:"status"`
	SrcIP     string `json:"srcIP"`
	DstIP     string `json:"dstIP"`
	Details   string `json:"details"`
}

AuthActivityEvent represents a unified authentication event from any protocol

type AuthActivityResponse 

type AuthActivityResponse struct {
	Events     []AuthActivityEvent `json:"events"`
	TotalCount int                 `json:"totalCount"`
}

AuthActivityResponse contains all authentication events

type BPFConfig 

type BPFConfig struct {
	Filter string `json:"filter"`
}

BPFConfig represents the BPF filter configuration

type BPFExample 

type BPFExample struct {
	Name        string `json:"name"`
	Filter      string `json:"filter"`
	Description string `json:"description"`
}

BPFExample represents a BPF filter example

type BPFInfoResponse 

type BPFInfoResponse struct {
	CurrentFilter string       `json:"currentFilter"`
	Examples      []BPFExample `json:"examples"`
	DocsURL       string       `json:"docsUrl"`
}

BPFInfoResponse contains BPF configuration and examples

type BehaviorHealth added in v0.15.4 

type BehaviorHealth = behavior.Health

type BehaviorOptions added in v0.15.4 

type BehaviorOptions = behaviorcommand.Options

type CertificateSummary 

type CertificateSummary struct {
	AssessmentTime      string   `json:"assessmentTimeNs"`
	AssessmentBasis     string   `json:"assessmentBasis"`
	ValidityState       string   `json:"validityState"`
	SelfSignatureState  string   `json:"selfSignatureState"`
	CertificateSender   string   `json:"certificateSender"`
	NotBeforeRFC3339    string   `json:"notBeforeRFC3339"`
	NotAfterRFC3339     string   `json:"notAfterRFC3339"`
	Timestamp           int64    `json:"timestamp"`
	SrcIP               string   `json:"srcIP"`
	SrcPort             int32    `json:"srcPort"`
	DstIP               string   `json:"dstIP"`
	DstPort             int32    `json:"dstPort"`
	SrcMAC              string   `json:"srcMAC"`
	DstMAC              string   `json:"dstMAC"`
	ChainIndex          int32    `json:"chainIndex"`
	SubjectCommonName   string   `json:"subjectCommonName"`
	SubjectAltNames     []string `json:"subjectAltNames"`
	SubjectOrganization string   `json:"subjectOrganization"`
	SubjectCountry      string   `json:"subjectCountry"`
	SubjectLocality     string   `json:"subjectLocality"`
	SubjectProvince     string   `json:"subjectProvince"`
	IssuerCommonName    string   `json:"issuerCommonName"`
	IssuerOrganization  string   `json:"issuerOrganization"`
	IssuerCountry       string   `json:"issuerCountry"`
	NotBefore           int64    `json:"notBefore"`
	NotAfter            int64    `json:"notAfter"`
	IsExpired           bool     `json:"isExpired"`
	IsSelfSigned        bool     `json:"isSelfSigned"`
	DaysUntilExpiration int64    `json:"daysUntilExpiration"`
	IsNotYetValid       bool     `json:"isNotYetValid"`
	HasWeakSignature    bool     `json:"hasWeakSignature"`
	HasShortKeySize     bool     `json:"hasShortKeySize"`
	SignatureAlgorithm  string   `json:"signatureAlgorithm"`
	PublicKeyAlgorithm  string   `json:"publicKeyAlgorithm"`
	PublicKeySize       int32    `json:"publicKeySize"`
	SerialNumber        string   `json:"serialNumber"`
	Version             int32    `json:"version"`
	SHA256Fingerprint   string   `json:"sha256Fingerprint"`
	SHA1Fingerprint     string   `json:"sha1Fingerprint"`
	KeyUsage            []string `json:"keyUsage"`
	ExtKeyUsage         []string `json:"extKeyUsage"`
	IsCA                bool     `json:"isCA"`
	MaxPathLen          int32    `json:"maxPathLen"`
	FirstSeen           int64    `json:"firstSeen"`
	LastSeen            int64    `json:"lastSeen"`
	SeenCount           int64    `json:"seenCount"`
	// JA4X certificate fingerprinting
	Ja4x            string `json:"ja4x"`
	Ja4xRaw         string `json:"ja4xRaw"`
	Ja4xDescription string `json:"ja4xDescription"`
	// Community ID for cross-tool correlation
	CommunityID  string   `json:"communityId"`
	CommunityIDs []string `json:"communityIds"`
}

CertificateSummary represents aggregated information for a single TLS certificate

type CertificatesResponse 

type CertificatesResponse struct {
	Certificates []CertificateSummary `json:"certificates"`
	TotalCount   int                  `json:"totalCount"`
}

CertificatesResponse contains the list of certificates

type ChartCoverage added in v0.16.0 

type ChartCoverage struct {
	Basis            string   `json:"basis"`
	SourceBuckets    int      `json:"sourceBuckets"`
	DisplayedBuckets int      `json:"displayedBuckets"`
	Sampled          bool     `json:"sampled"`
	Limitations      []string `json:"limitations"`
}

type ChartDataPoint 

type ChartDataPoint struct {
	Timestamp int64   `json:"timestamp"`
	Value     float64 `json:"value"`
}

ChartDataPoint represents a single data point in a chart

type ChartDataResponse 

type ChartDataResponse struct {
	Coverage ChartCoverage    `json:"coverage"`
	Type     string           `json:"type"`
	Field    string           `json:"field"`
	Interval string           `json:"interval"`
	Data     []ChartDataPoint `json:"data"`
	Count    int              `json:"count"`
	MinValue float64          `json:"minValue"`
	MaxValue float64          `json:"maxValue"`
	AvgValue float64          `json:"avgValue"`
}

ChartDataResponse contains the chart data and metadata

type ChartFieldInfo 

type ChartFieldInfo struct {
	Name        string `json:"name"`
	Type        string `json:"type"`
	Description string `json:"description"`
}

ChartFieldInfo represents metadata about a field for charting

type ChartFieldsResponse 

type ChartFieldsResponse struct {
	Discovery     string           `json:"discovery"`
	SampleLimit   int              `json:"sampleLimit"`
	Type          string           `json:"type"`
	Fields        []ChartFieldInfo `json:"fields"`
	TotalFields   int              `json:"totalFields"`   // Total possible fields including empty ones
	FilteredCount int              `json:"filteredCount"` // Number of fields filtered out due to no data
}

ChartFieldsResponse lists available numeric fields for charting

type ChartGenerator 

type ChartGenerator struct {
	Coverage RenderedChartCoverage
	// contains filtered or unexported fields
}

ChartGenerator handles chart generation from audit records

func NewChartGenerator 

func NewChartGenerator(auditType, field, chartType, interval string, showLegend bool, maxDataPoints int) *ChartGenerator

NewChartGenerator creates a new chart generator

func (*ChartGenerator) GenerateChart 

func (cg *ChartGenerator) GenerateChart(outDir string) (io.Reader, error)

GenerateChart generates a chart and returns it as HTML

func (*ChartGenerator) GenerateChartFromDirs added in v0.9.1 

func (cg *ChartGenerator) GenerateChartFromDirs(outDirs []string) (io.Reader, error)

GenerateChartFromDirs generates a chart aggregating audit records from multiple output directories. When called with a single directory it behaves identically to GenerateChart. Directories that don't contain the requested audit file are skipped silently. Returns an error if no directory yields any data.

type CollectorInterface 

type CollectorInterface interface {
	SetLogLevel(debug bool)
	ReloadRulesEngine() error
	// Live statistics methods
	GetCurrentPacketCount() int64
	GetTotalPacketCount() int64
	GetPacketsPerSecond() int64
	GetProfilesCount() int
	GetServicesCount() int
}

CollectorInterface defines the methods we need from the Collector

type ConfigOption 

type ConfigOption struct {
	Name        string `json:"name"`
	Value       any    `json:"value"`
	Default     any    `json:"default"`
	Type        string `json:"type"`
	Description string `json:"description"`
	Category    string `json:"category"`
	IsEditable  bool   `json:"isEditable"`
}

ConfigOption represents a configuration option

type ConnectionSummary 

type ConnectionSummary struct {
	DNSResolvedName      string   `json:"dnsResolvedName,omitempty"`
	DNSResolvedAtNs      string   `json:"dnsResolvedAtNs,omitempty"`
	DNSResolutionState   string   `json:"dnsResolutionState,omitempty"`
	TimestampFirst       int64    `json:"timestampFirst"`
	TimestampLast        int64    `json:"timestampLast"`
	TimestampFirstNs     string   `json:"timestampFirstNs"`
	TimestampLastNs      string   `json:"timestampLastNs"`
	LinkProto            string   `json:"linkProto"`
	NetworkProto         string   `json:"networkProto"`
	TransportProto       string   `json:"transportProto"`
	ApplicationProto     string   `json:"applicationProto"`
	SrcMAC               string   `json:"srcMAC"`
	DstMAC               string   `json:"dstMAC"`
	SrcIP                string   `json:"srcIP"`
	SrcPort              string   `json:"srcPort"`
	DstIP                string   `json:"dstIP"`
	DstPort              string   `json:"dstPort"`
	TotalSize            int32    `json:"totalSize"`
	AppPayloadSize       int32    `json:"appPayloadSize"`
	NumPackets           int32    `json:"numPackets"`
	Duration             int64    `json:"duration"`
	BytesClientToServer  int64    `json:"bytesClientToServer"`
	BytesServerToClient  int64    `json:"bytesServerToClient"`
	NumFINFlags          int32    `json:"numFINFlags"`
	NumRSTFlags          int32    `json:"numRSTFlags"`
	NumACKFlags          int32    `json:"numACKFlags"`
	NumSYNFlags          int32    `json:"numSYNFlags"`
	NumURGFlags          int32    `json:"numURGFlags"`
	NumECEFlags          int32    `json:"numECEFlags"`
	NumPSHFlags          int32    `json:"numPSHFlags"`
	NumCWRFlags          int32    `json:"numCWRFlags"`
	NumNSFlags           int32    `json:"numNSFlags"`
	MeanWindowSize       int32    `json:"meanWindowSize"`
	Applications         []string `json:"applications"`
	ServerPortName       string   `json:"serverPortName"`
	DetectedProtocolName string   `json:"detectedProtocolName"`
	// JA4L timing fields
	TcpRttNanos       int64  `json:"tcpRttNanos"`
	TlsHandshakeNanos int64  `json:"tlsHandshakeNanos"`
	Ja4lClient        string `json:"ja4lClient"`
	Ja4lServer        string `json:"ja4lServer"`
	SynTtl            int32  `json:"synTtl"`
	// Security behavioral analysis fields
	PacketsClientToServer       int64   `json:"packetsClientToServer"`
	PacketsServerToClient       int64   `json:"packetsServerToClient"`
	ByteRatio                   float64 `json:"byteRatio"`
	PacketRatio                 float64 `json:"packetRatio"`
	AvgPacketSizeClientToServer int32   `json:"avgPacketSizeClientToServer"`
	AvgPacketSizeServerToClient int32   `json:"avgPacketSizeServerToClient"`
	IsExternal                  bool    `json:"isExternal"`
	IsBroadcast                 bool    `json:"isBroadcast"`
	IsMulticast                 bool    `json:"isMulticast"`
	// TLS SNI
	Sni string `json:"sni"`
	// Community ID for cross-tool correlation
	CommunityID             string `json:"communityId"`
	ObservationID           string `json:"observationId,omitempty"`
	SnapshotSequence        uint64 `json:"snapshotSequence,string"`
	CounterSemantics        string `json:"counterSemantics,omitempty"`
	TotalSize64             int64  `json:"totalSize64,string"`
	AppPayloadSize64        int64  `json:"appPayloadSize64,string"`
	NumPackets64            int64  `json:"numPackets64,string"`
	LegacyCountersSaturated bool   `json:"legacyCountersSaturated"`
	ObservationBoundary     string `json:"observationBoundary,omitempty"`
}

ConnectionSummary represents aggregated information for a single connection

type ConnectionsResponse 

type ConnectionsResponse struct {
	Connections []ConnectionSummary `json:"connections"`
	TotalCount  int                 `json:"totalCount"`
}

ConnectionsResponse contains the list of connections

type ConversationDataResponse 

type ConversationDataResponse struct {
	SrcIP            string `json:"srcIP"`
	SrcPort          string `json:"srcPort"`
	DstIP            string `json:"dstIP"`
	DstPort          string `json:"dstPort"`
	Protocol         string `json:"protocol"`
	ConversationData string `json:"conversationData"` // base64-encoded chunk
	Exists           bool   `json:"exists"`
	FilePath         string `json:"filePath"`
	TotalSize        int64  `json:"totalSize"` // Total file size in bytes
	ChunkSize        int    `json:"chunkSize"` // Size of this chunk
	Offset           int64  `json:"offset"`    // Current offset
	HasMore          bool   `json:"hasMore"`   // Whether there's more data
	ErrorMessage     string `json:"errorMessage,omitempty"`
}

ConversationDataResponse contains the raw conversation data for a connection

type CreateInjectionRuleRequest 

type CreateInjectionRuleRequest struct {
	Name         string         `json:"name"`
	Description  string         `json:"description"`
	Type         string         `json:"type"`
	Expression   string         `json:"expression"`
	Action       string         `json:"action"`
	ActionConfig map[string]any `json:"actionConfig,omitempty"`
	Enabled      bool           `json:"enabled"`
	Priority     int            `json:"priority,omitempty"`
	StopOnMatch  bool           `json:"stopOnMatch,omitempty"`
	Tags         []string       `json:"tags,omitempty"`
}

CreateInjectionRuleRequest represents a request to create a new injection rule

type CreateRuleRequest 

type CreateRuleRequest struct {
	Name              string              `json:"name"`
	Description       string              `json:"description"`
	Type              string              `json:"type"`
	Expression        string              `json:"expression"`
	Severity          string              `json:"severity"`
	MITRE             []string            `json:"mitre"`
	Tags              []string            `json:"tags"`
	Enabled           bool                `json:"enabled"`
	Threshold         int                 `json:"threshold,omitempty"`
	ThresholdWindow   int                 `json:"thresholdWindow,omitempty"`
	DistinctField     string              `json:"distinctField,omitempty"`
	DistinctThreshold int                 `json:"distinctThreshold,omitempty"`
	Actions           []ResponseActionAPI `json:"actions,omitempty"`
}

CreateRuleRequest represents a request to create a new rule

type DNSTransactionSummary added in v0.15.4 

type DNSTransactionSummary struct {
	Queries         int   `json:"queries"`
	Retransmissions int   `json:"retransmissions"`
	Answered        int   `json:"answered"`
	Late            int   `json:"late"`
	Unsolicited     int   `json:"unsolicited"`
	Reordered       int   `json:"reordered"`
	Unanswered      int   `json:"unanswered"`
	RTTSamples      int   `json:"rttSamples"`
	RTTMedianNS     int64 `json:"rttMedianNs"`
	RTTP95NS        int64 `json:"rttP95Ns"`
	RTTTruncated    bool  `json:"rttTruncated"`
}

DNSTransactionSummary aggregates DNS.TransactionStatus and DNS.RTT. Unanswered is a lower bound: queries minus responses paired to them.

type DPIInfo 

type DPIInfo struct {
	Enabled              bool                `json:"enabled"`
	HasSupport           bool                `json:"hasSupport"`
	NDPIVersion          string              `json:"ndpiVersion"`
	LibprotoidentVersion string              `json:"libprotoidentVersion"`
	GoDPIVersion         string              `json:"goDpiVersion"`
	ActiveModules        []string            `json:"activeModules"`
	AvailableModules     []string            `json:"availableModules"`
	ModuleProtocols      map[string][]string `json:"moduleProtocols"` // New: protocols supported by each module
	// External documentation links for supported protocols
	NDPIProtocolsURL          string `json:"ndpiProtocolsUrl"`
	LibprotoidentProtocolsURL string `json:"libprotoidentProtocolsUrl"`
}

DPIInfo represents DPI configuration and version information

type Dashboard added in v0.9.1 

type Dashboard struct {
	ID          string           `json:"id"`
	Name        string           `json:"name"`
	Description string           `json:"description,omitempty"`
	Charts      []DashboardChart `json:"charts"`
	GridCols    int              `json:"gridCols"`
	RowHeight   int              `json:"rowHeight"`
	CreatedAt   int64            `json:"createdAt"`
	UpdatedAt   int64            `json:"updatedAt"`
	Builtin     bool             `json:"builtin,omitempty"`
}

Dashboard is a saved collection of charts with layout metadata.

type DashboardChart added in v0.9.1 

type DashboardChart struct {
	ID            string               `json:"id"`
	Title         string               `json:"title"`
	Description   string               `json:"description,omitempty"`
	AuditType     string               `json:"auditType"`
	Field         string               `json:"field"`
	ChartType     string               `json:"chartType"`
	Interval      string               `json:"interval,omitempty"`
	ShowLegend    bool                 `json:"showLegend"`
	MaxDataPoints int                  `json:"maxDataPoints,omitempty"`
	Layout        DashboardChartLayout `json:"layout"`
}

DashboardChart is one tile inside a dashboard.

type DashboardChartLayout added in v0.9.1 

type DashboardChartLayout struct {
	X int `json:"x"`
	Y int `json:"y"`
	W int `json:"w"`
	H int `json:"h"`
}

DashboardChartLayout describes a chart's position and size on a 12-column grid.

type DatabaseDownloadStatus added in v0.15.4 

type DatabaseDownloadStatus struct {
	State      DownloadState     `json:"state"`
	Stage      dbs.DownloadStage `json:"stage,omitempty"`
	Version    string            `json:"version,omitempty"`
	Downloaded int64             `json:"downloaded"`
	Total      int64             `json:"total"`
	Percent    float64           `json:"percent"`
	Message    string            `json:"message,omitempty"`
	Error      string            `json:"error,omitempty"`
	StartedAt  int64             `json:"startedAt,omitempty"`
	FinishedAt int64             `json:"finishedAt,omitempty"`
}

DatabaseDownloadStatus is the observable state of the database download.

type DatabaseStatus added in v0.15.4 

type DatabaseStatus struct {
	DeviceCatalogues []resolvers.DeviceCatalogueStatus `json:"deviceCatalogues"`
	GeoProviders     string                            `json:"geoProviders"`
	GeoStatus        []resolvers.GeoProviderStatus     `json:"geoStatus"`
	GeoError         string                            `json:"geoError,omitempty"`
	// Satisfied is true when no required database is absent.
	Satisfied bool `json:"satisfied"`
	// Missing lists the absent required databases.
	Missing []MissingDB `json:"missing"`
	// DatabaseDir is the resolved location, so a support request can name a
	// real path instead of "~/.config/netcap/dbs" which is wrong on Windows.
	DatabaseDir string `json:"databaseDir"`
	// Download is the state of any download that has been started.
	Download DatabaseDownloadStatus `json:"download"`
}

DatabaseStatus answers "can this install analyse a capture at full fidelity, and if not, what is missing and is a fix already running".

type DecoderConfig 

type DecoderConfig struct {
	IncludeDecoders string   `json:"includeDecoders"`
	ExcludeDecoders string   `json:"excludeDecoders"`
	EnabledDecoders []string `json:"enabledDecoders"`
}

DecoderConfig represents the decoder configuration that can be saved

type DecoderConfigFile 

type DecoderConfigFile struct {
	Name         string `json:"name"`
	Path         string `json:"path"`
	ModifiedTime int64  `json:"modifiedTime"`
	Size         int64  `json:"size"`
}

DecoderConfigFile represents metadata about a saved decoder configuration file

type DecoderFieldsResponse 

type DecoderFieldsResponse struct {
	DecoderName string      `json:"decoderName"`
	Fields      []FieldInfo `json:"fields"`
}

DecoderFieldsResponse represents the response with field information for a decoder

type DecoderInfo 

type DecoderInfo struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Type        string `json:"type"`
	Layer       string `json:"layer,omitempty"`
	Port        int32  `json:"port,omitempty"`
	Enabled     bool   `json:"enabled"`
}

DecoderInfo represents information about a decoder

type DecodersResponse 

type DecodersResponse struct {
	Packet   []DecoderInfo `json:"packet"`
	GoPacket []DecoderInfo `json:"gopacket"`
	Stream   []DecoderInfo `json:"stream"`
	Abstract []DecoderInfo `json:"abstract"`
}

DecodersResponse represents the response with all decoder information

type DeviceProfileSummary 

type DeviceProfileSummary struct {
	MacAddr            string   `json:"macAddr"`
	DeviceManufacturer string   `json:"deviceManufacturer"`
	NumDeviceIPs       int      `json:"numDeviceIPs"`
	NumContacts        int      `json:"numContacts"`
	NumPackets         int64    `json:"numPackets"`
	Bytes              uint64   `json:"bytes"`
	Timestamp          int64    `json:"timestamp"`
	Applications       []string `json:"applications"`
	Devices            []string `json:"devices"`
	DeviceIPs          []string `json:"deviceIPs"`
	Contacts           []string `json:"contacts"`
	Hostnames          []string `json:"hostnames"`
	DeviceTypes        []string `json:"deviceTypes"`
	OS                 string   `json:"os"`
	Roles              []string `json:"roles"`
}

DeviceProfileSummary represents aggregated information for a single device

type DevicesResponse 

type DevicesResponse struct {
	Devices    []DeviceProfileSummary `json:"devices"`
	TotalCount int                    `json:"totalCount"`
}

DevicesResponse contains the list of device profiles

type DomainSummary 

type DomainSummary struct {
	Domain        string   `json:"domain"`
	QueryCount    int      `json:"queryCount"`
	UniqueClients int      `json:"uniqueClients"`
	RecordTypes   []string `json:"recordTypes"`
	ResponseCodes []int32  `json:"responseCodes"`
	FirstSeen     int64    `json:"firstSeen"`
	LastSeen      int64    `json:"lastSeen"`
	IsSubdomain   bool     `json:"isSubdomain"`
	ParentDomain  string   `json:"parentDomain"`
	ResolvedIPs   []string `json:"resolvedIPs"`
	Source        string   `json:"source"`       // "DNS" or "TLS SNI"
	CommunityIDs  []string `json:"communityIds"` // Community IDs for cross-tool correlation
	// Capture-time DNS query/response pairing; absent for SNI-only domains.
	Transactions *DNSTransactionSummary `json:"dnsTransactions,omitempty"`
}

DomainSummary represents aggregated information for a single domain

type DomainsResponse 

type DomainsResponse struct {
	Domains    []DomainSummary `json:"domains"`
	TotalCount int             `json:"totalCount"`
}

DomainsResponse contains the list of domains

type DownloadState added in v0.15.4 

type DownloadState string

DownloadState is the lifecycle of the database download, as opposed to dbs.DownloadStage which is the phase within a running one. 

const (
	DownloadIdle      DownloadState = "idle"
	DownloadRunning   DownloadState = "running"
	DownloadCompleted DownloadState = "completed"
	DownloadFailed    DownloadState = "failed"
)

Database download lifecycle states.

type ExecuteAllRulesResponse 

type ExecuteAllRulesResponse struct {
	Success       bool             `json:"success"`
	Message       string           `json:"message"`
	TotalAlerts   int              `json:"totalAlerts"`
	TotalRecords  int              `json:"totalRecords"`
	ExecutionTime int64            `json:"executionTimeMs"`
	RuleResults   []RuleExecResult `json:"ruleResults"`
}

ExecuteAllRulesResponse represents the response from executing all rules

type ExecuteRuleRequest 

type ExecuteRuleRequest struct {
	RuleID string `json:"ruleId"`
}

ExecuteRuleRequest represents a request to execute a rule on demand

type ExecuteRuleResponse 

type ExecuteRuleResponse struct {
	Success       bool   `json:"success"`
	Message       string `json:"message"`
	AlertsCount   int    `json:"alertsCount"`
	RecordsRead   int    `json:"recordsRead"`
	ExecutionTime int64  `json:"executionTimeMs"`
}

ExecuteRuleResponse represents the response from executing a rule

type ExploitSummary 

type ExploitSummary struct {
	ID           string        `json:"id"`
	Description  string        `json:"description"`
	File         string        `json:"file"`
	Date         string        `json:"date"`
	Author       string        `json:"author"`
	Type         string        `json:"type"`
	Platform     string        `json:"platform"`
	Port         string        `json:"port"`
	Count        int           `json:"count"`
	Software     *SoftwareInfo `json:"software"`     // Software details including flows
	Affected     int           `json:"affected"`     // Number of affected hosts
	CommunityIDs []string      `json:"communityIds"` // Community IDs for cross-tool correlation
}

ExploitSummary represents aggregated exploit information

type FeatureState added in v0.15.4 

type FeatureState struct {
	Name        string `json:"name"`
	Title       string `json:"title"`
	Description string `json:"description"`
	Scope       string `json:"scope"`
	Flag        string `json:"flag"`
	Env         string `json:"env"`
	Enabled     bool   `json:"enabled"`
}

FeatureState is one optional capability as shown in Settings.

type FieldInfo 

type FieldInfo struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

FieldInfo represents information about a field in an audit record

func GetRecordFields 

func GetRecordFields(record any) []FieldInfo

GetRecordFields extracts field information from an audit record This includes nested fields using dot notation (e.g., "ReqCookies.Name")

type FieldValuesResponse 

type FieldValuesResponse struct {
	RecordType    string              `json:"recordType"`
	FieldValues   map[string][]string `json:"fieldValues"`
	SampleSize    int                 `json:"sampleSize"`
	MaxPerField   int                 `json:"maxPerField"`
	RecordScanned int                 `json:"recordsScanned"`
}

FieldValuesResponse is the API response for field values

type FieldsResponse 

type FieldsResponse struct {
	RecordType string      `json:"recordType"`
	Fields     []FieldInfo `json:"fields"`
	Helpers    []string    `json:"helpers"`
}

FieldsResponse is the API response for field information

type FileError 

type FileError struct {
	InputFile    string `json:"inputFile"`
	Error        string `json:"error"`
	Timestamp    int64  `json:"timestamp"`
	ErrorLogPath string `json:"errorLogPath,omitempty"` // Path to detailed error log file
}

FileError represents an error that occurred during file processing

type FileInfo 

type FileInfo struct {
	ID               string                `json:"id"` // Unique identifier for the file (used for API calls)
	Name             string                `json:"name"`
	Path             string                `json:"path"`
	Size             int64                 `json:"size"`
	ModifiedTime     int64                 `json:"modifiedTime"`
	IsCompleted      bool                  `json:"isCompleted"`
	Error            *string               `json:"error,omitempty"`
	ErrorLogPath     *string               `json:"errorLogPath,omitempty"`   // Path to detailed error log file
	BPFFilter        string                `json:"bpfFilter,omitempty"`      // BPF filter used during capture
	ProcessingTime   float64               `json:"processingTime,omitempty"` // Processing duration in seconds
	Hash             string                `json:"hash,omitempty"`           // SHA256 hash of the file
	HasReportedIssue bool                  `json:"hasReportedIssue"`         // Whether an issue report has been submitted for this file
	SessionID        string                `json:"sessionId,omitempty"`      // Session ID (service mode only)
	ParentSessionID  string                `json:"parentSessionId,omitempty"`
	ParentInputFile  string                `json:"parentInputFile,omitempty"`
	ParentRunID      string                `json:"parentRunId,omitempty"`
	AnalysisSelector string                `json:"analysisSelector,omitempty"`
	PacketSelection  *childPacketSelection `json:"packetSelection,omitempty"`

	// ErrorLogID is the identifier to pass to /api/error-log/{id}: the session
	// ID in service mode, the hashed file ID in local mode.
	//
	// It exists because the UI used to key the crash-log button on SessionID,
	// a field local mode never sets — so the desktop app, which is always
	// local mode, rendered no way to read a failure and offered only a retry
	// that failed identically.
	ErrorLogID string `json:"errorLogId,omitempty"`
}

FileInfo represents file metadata

type FilteredAuditFileInfo 

type FilteredAuditFileInfo struct {
	AuditFileInfo
	FilteredCount int64 `json:"filteredCount"`
}

FilteredAuditFileInfo extends AuditFileInfo with filtered count

func ListAuditFilesWithCommunityIDFilter 

func ListAuditFilesWithCommunityIDFilter(outputDir string, communityIDs map[string]bool) ([]FilteredAuditFileInfo, error)

ListAuditFilesWithCommunityIDFilter returns audit files with filtered counts by community IDs

type FingerprintSummary 

type FingerprintSummary struct {
	Fingerprint           string   `json:"fingerprint"`
	Type                  string   `json:"type"` // JA4, JA4S, JA4H, JA4X, JA4T, JA4TS, JA4SSH, or DHCP
	Count                 int      `json:"count"`
	Hosts                 []string `json:"hosts"`
	HostsTotal            int      `json:"hostsTotal"`
	HostsTruncated        bool     `json:"hostsTruncated"`
	Description           string   `json:"description"`
	FirstSeen             int64    `json:"firstSeen"`
	LastSeen              int64    `json:"lastSeen"`
	CommunityIDs          []string `json:"communityIds"`
	CommunityIDsTotal     int      `json:"communityIdsTotal"`
	CommunityIDsTruncated bool     `json:"communityIdsTruncated"`
}

FingerprintSummary represents aggregated fingerprint information.

Hosts and CommunityIDs are capped server-side (see maxHostsPerRow and maxCommunityIDsPerRow). HostsTotal / CommunityIDsTotal carry the pre-cap counts so the UI can display "X of Y" hints.

type FingerprintsResponse 

type FingerprintsResponse struct {
	Fingerprints []FingerprintSummary `json:"fingerprints"`
	TotalCount   int                  `json:"totalCount"` // post-filter, pre-pagination
	Offset       int                  `json:"offset"`
	Limit        int                  `json:"limit"`
	Stats        FingerprintsStats    `json:"stats"`
}

FingerprintsResponse contains the list of fingerprints

type FingerprintsStats added in v0.15.4 

type FingerprintsStats struct {
	TotalFingerprints int            `json:"totalFingerprints"`
	TotalOccurrences  int            `json:"totalOccurrences"`
	CountsByType      map[string]int `json:"countsByType"`
}

FingerprintsStats summarises the full dataset (independent of the current page) so the UI can render summary cards without scanning the entire list client-side.

type GroupedAlert 

type GroupedAlert struct {
	RuleName        string          `json:"ruleName"`
	Description     string          `json:"description"`
	Severity        string          `json:"severity"`
	RecordType      string          `json:"recordType"`
	Tags            []string        `json:"tags"`
	MITRE           string          `json:"mitre"`
	RuleExpression  string          `json:"ruleExpression"`
	Threshold       int32           `json:"threshold"`
	ThresholdWindow int32           `json:"thresholdWindow"`
	Count           int             `json:"count"`
	FirstSeen       int64           `json:"firstSeen"`
	LastSeen        int64           `json:"lastSeen"`
	UniqueSrcIPs    []string        `json:"uniqueSrcIPs"`
	UniqueDstIPs    []string        `json:"uniqueDstIPs"`
	UniqueSrcPorts  []string        `json:"uniqueSrcPorts"`
	UniqueDstPorts  []string        `json:"uniqueDstPorts"`
	SampleAlerts    []AlertResponse `json:"sampleAlerts"`  // Keep a few samples for detail view
	Resolved        bool            `json:"resolved"`      // True if all alerts in this group are resolved
	ResolvedCount   int             `json:"resolvedCount"` // Number of resolved alerts in this group
	GroupID         string          `json:"groupId"`       // Unique identifier for the group
}

GroupedAlert represents a deduplicated/grouped alert

type GroupedAlertsResponse 

type GroupedAlertsResponse struct {
	Groups     []GroupedAlert `json:"groups"`
	TotalCount int            `json:"totalCount"` // Total individual alerts
	GroupCount int            `json:"groupCount"` // Number of unique groups
}

GroupedAlertsResponse represents the response containing grouped/deduplicated alerts

type HTTPResponse 

type HTTPResponse struct {
	HTTP       []HTTPSummary `json:"http"`
	TotalCount int           `json:"totalCount"`
}

HTTPResponse contains the list of HTTP records

type HTTPSummary 

type HTTPSummary struct {
	TimestampNs            string            `json:"timestampNs"`
	ReassemblyStatus       string            `json:"reassemblyStatus"`
	Timestamp              int64             `json:"timestamp"`
	Proto                  string            `json:"proto"`
	Method                 string            `json:"method"`
	Host                   string            `json:"host"`
	URL                    string            `json:"url"`
	UserAgent              string            `json:"userAgent"`
	Referer                string            `json:"referer"`
	ReqContentLength       int32             `json:"reqContentLength"`
	ResContentLength       int32             `json:"resContentLength"`
	ContentType            string            `json:"contentType"`
	StatusCode             int32             `json:"statusCode"`
	SrcIP                  string            `json:"srcIP"`
	DstIP                  string            `json:"dstIP"`
	SrcPort                int32             `json:"srcPort"`
	DstPort                int32             `json:"dstPort"`
	Flow                   string            `json:"flow"`
	ReqContentEncoding     string            `json:"reqContentEncoding"`
	ResContentEncoding     string            `json:"resContentEncoding"`
	ServerName             string            `json:"serverName"`
	ResContentType         string            `json:"resContentType"`
	ContentTypeDetected    string            `json:"contentTypeDetected"`
	ResContentTypeDetected string            `json:"resContentTypeDetected"`
	DoneAfter              int64             `json:"doneAfter"`
	DNSDoneAfter           int64             `json:"dnsDoneAfter"`
	FirstByteAfter         int64             `json:"firstByteAfter"`
	TLSDoneAfter           int64             `json:"tlsDoneAfter"`
	RequestHeader          map[string]string `json:"requestHeader"`
	ResponseHeader         map[string]string `json:"responseHeader"`
	Parameters             map[string]string `json:"parameters"`
	// Security headers
	StrictTransportSecurity  string `json:"strictTransportSecurity"`
	ContentSecurityPolicy    string `json:"contentSecurityPolicy"`
	XContentTypeOptions      string `json:"xContentTypeOptions"`
	XFrameOptions            string `json:"xFrameOptions"`
	XXSSProtection           string `json:"xXSSProtection"`
	ReferrerPolicy           string `json:"referrerPolicy"`
	AccessControlAllowOrigin string `json:"accessControlAllowOrigin"`
	HasServerTiming          bool   `json:"hasServerTiming"`
	// Authentication and server info
	AuthorizationType string `json:"authorizationType"`
	XForwardedFor     string `json:"xForwardedFor"`
	XRealIP           string `json:"xRealIP"`
	Server            string `json:"server"`
	XPoweredBy        string `json:"xPoweredBy"`
	// JA4H fingerprinting
	Ja4h            string `json:"ja4h"`
	Ja4hDescription string `json:"ja4hDescription"`
	// Community ID for cross-tool correlation
	CommunityID string `json:"communityId"`
}

HTTPSummary represents HTTP request/response information

type HarvesterInfo 

type HarvesterInfo struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	Ports       []int  `json:"ports"`
}

HarvesterInfo represents information about a credential harvester

type HarvesterPresetInfo 

type HarvesterPresetInfo struct {
	Name           string    `json:"name"`
	Description    string    `json:"description"`
	CreatedAt      time.Time `json:"created_at"`
	ModifiedAt     time.Time `json:"modified_at"`
	HarvesterCount int       `json:"harvester_count"`
}

HarvesterPresetInfo represents metadata about a saved harvester configuration preset

type HarvesterPresetListResponse 

type HarvesterPresetListResponse struct {
	Presets []HarvesterPresetInfo `json:"presets"`
}

HarvesterPresetListResponse represents the response with all saved presets

type HarvestersResponse 

type HarvestersResponse struct {
	Harvesters []HarvesterInfo `json:"harvesters"`
}

HarvestersResponse represents the response with all harvester information

type HostSummary added in v0.9.1 

type HostSummary struct {
	Addr                string         `json:"addr"`
	NumPackets          int64          `json:"numPackets"`
	Bytes               uint64         `json:"bytes"`
	Geolocation         string         `json:"geolocation"`
	DNSNames            []string       `json:"dnsNames"`
	TimestampFirst      int64          `json:"timestampFirst"`
	TimestampLast       int64          `json:"timestampLast"`
	Applications        []string       `json:"applications"`
	Ja4Fingerprints     []string       `json:"ja4Fingerprints"`
	Ja4SFingerprints    []string       `json:"ja4sFingerprints"`
	ProtocolsCount      int            `json:"protocolsCount"`
	SNIsCount           int            `json:"snisCount"`
	SrcPortsCount       int            `json:"srcPortsCount"`
	DstPortsCount       int            `json:"dstPortsCount"`
	ContactedPortsCount int            `json:"contactedPortsCount"`
	TopProtocols        []ProtocolInfo `json:"topProtocols"`
	TopSrcPorts         []PortInfo     `json:"topSrcPorts"`
	TopDstPorts         []PortInfo     `json:"topDstPorts"`
	TopContactedPorts   []PortInfo     `json:"topContactedPorts"`
	IsInternal          bool           `json:"isInternal"`
}

HostSummary represents aggregated information for a single IP address

type HostVulnerabilitySummary 

type HostVulnerabilitySummary struct {
	Host            string `json:"host"`
	Vulnerabilities int    `json:"vulnerabilities"`
	Exploits        int    `json:"exploits"`
	TopSeverity     string `json:"topSeverity"`
	SoftwareCount   int    `json:"softwareCount"`
}

HostVulnerabilitySummary represents a host and its vulnerabilities

type HostsResponse 

type HostsResponse struct {
	Hosts      []HostSummary      `json:"hosts"`
	TotalCount int                `json:"totalCount"`
	Identity   hostIdentityReport `json:"identity"`
}

HostsResponse contains the list of IP profiles

type HyperscanInfo added in v0.9.1 

type HyperscanInfo struct {
	// Enabled is true when this binary was compiled with -tags hyperscan
	// AND libhs is linked.
	Enabled bool `json:"enabled"`

	// LibVersion is the libhs runtime version string (or "disabled" when
	// the integration is compiled out).
	LibVersion string `json:"lib_version"`

	// BuildTag echoes the Go build tag required to enable HS.
	BuildTag string `json:"build_tag"`

	// DocsURL points to the in-tree docs page so the UI can deep-link.
	DocsURL string `json:"docs_url"`

	// Subsystems is keyed by subsystem name (e.g. "service_probes",
	// "cms", "rules"). Each value is the JSON snapshot the subsystem
	// chooses to expose.
	Subsystems map[string]any `json:"subsystems"`
}

HyperscanInfo describes the Hyperscan / Vectorscan integration state for the web UI. Independent of the build tag — when the binary was compiled without `-tags hyperscan` the handler still answers, with Enabled=false so the UI can render an explicit "disabled" badge instead of timing out.

`Subsystems` carries one entry per registered Hyperscan consumer (service probes, CMS detection, rule engine, …). The map values are arbitrary JSON owned by the producer; consumers can render whatever fields they care about.

type IPTracker 

type IPTracker struct {
	IP               string
	AnalysisTimes    []time.Time
	Sessions         []string    // Session IDs
	IssueReportTimes []time.Time // Timestamps of issue reports for rate limiting
}

IPTracker tracks analysis attempts per IP for rate limiting

type InjectionEvent 

type InjectionEvent struct {
	ID         string         `json:"id"`
	Timestamp  int64          `json:"timestamp"`
	RuleName   string         `json:"ruleName"`
	RuleAction string         `json:"ruleAction"`
	RecordType string         `json:"recordType"`
	SrcIP      string         `json:"srcIP,omitempty"`
	DstIP      string         `json:"dstIP,omitempty"`
	SrcPort    int            `json:"srcPort,omitempty"`
	DstPort    int            `json:"dstPort,omitempty"`
	Result     string         `json:"result"` // "success", "failed", "skipped"
	Error      string         `json:"error,omitempty"`
	ActionData map[string]any `json:"actionData,omitempty"`
}

InjectionEvent represents an event when an injection rule is triggered

type InjectionEventsResponse 

type InjectionEventsResponse struct {
	Events     []InjectionEvent `json:"events"`
	TotalCount int              `json:"totalCount"`
}

InjectionEventsResponse represents the response containing injection events

type InjectionRuleResponse 

type InjectionRuleResponse struct {
	ID           string         `json:"id"`
	Name         string         `json:"name"`
	Description  string         `json:"description"`
	Type         string         `json:"type"`
	Expression   string         `json:"expression"`
	Action       string         `json:"action"`
	ActionConfig map[string]any `json:"actionConfig,omitempty"`
	Enabled      bool           `json:"enabled"`
	Priority     int            `json:"priority"`
	StopOnMatch  bool           `json:"stopOnMatch"`
	Tags         []string       `json:"tags"`
}

InjectionRuleResponse represents an injection rule for the API

type InjectionRulesResponse 

type InjectionRulesResponse struct {
	Rules       []InjectionRuleResponse `json:"rules"`
	Description string                  `json:"description"`
}

InjectionRulesResponse represents the response containing all injection rules

type InjectionStatsResponse 

type InjectionStatsResponse struct {
	TotalRules     int            `json:"totalRules"`
	EnabledRules   int            `json:"enabledRules"`
	TotalEvents    int            `json:"totalEvents"`
	EventsByRule   map[string]int `json:"eventsByRule"`
	EventsByResult map[string]int `json:"eventsByResult"`
	EventsByAction map[string]int `json:"eventsByAction"`
	LastEventTime  int64          `json:"lastEventTime,omitempty"`
}

InjectionStatsResponse represents statistics about injection rules and events

type LayerType 

type LayerType int

LayerType represents the encapsulation layer of a protocol 

const (
	LayerLink LayerType = iota
	LayerNetwork
	LayerTransport
	LayerApplication
	LayerStream
	LayerAbstract
	LayerUnknown
)

func GetLayerType 

func GetLayerType(auditType string) LayerType

GetLayerType returns the layer type for a given audit record type 

type MenuCountsResponse struct {
	HostsCount           int64 `json:"hostsCount"`
	DevicesCount         int64 `json:"devicesCount"`
	ConnectionsCount     int64 `json:"connectionsCount"`
	HTTPCount            int64 `json:"httpCount"`
	CertificatesCount    int64 `json:"certificatesCount"`
	SecretCount          int64 `json:"secretCount"`
	DomainsCount         int64 `json:"domainsCount"`
	FingerprintsCount    int64 `json:"fingerprintsCount"`
	SoftwareCount        int64 `json:"softwareCount"`
	VulnerabilitiesCount int64 `json:"vulnerabilitiesCount"`
	AuditRecordsCount    int64 `json:"auditRecordsCount"`
	ServicesCount        int64 `json:"servicesCount"`
	LogsCount            int64 `json:"logsCount"`
	AlertsGroupCount     int64 `json:"alertsGroupCount"`
	ExtractedFilesCount  int64 `json:"extractedFilesCount"`
}

MenuCountsResponse contains all menu badge counts for efficient loading

type MissingDB added in v0.15.4 

type MissingDB struct {
	File    string `json:"file"`
	Feature string `json:"feature"`
}

MissingDB is one absent database, reported to the UI.

type NetworkConversationDataResponse 

type NetworkConversationDataResponse struct {
	SrcIP            string `json:"srcIP"`
	DstIP            string `json:"dstIP"`
	Protocol         string `json:"protocol"`
	ConversationData string `json:"conversationData"` // base64-encoded chunk
	Exists           bool   `json:"exists"`
	FilePath         string `json:"filePath"`
	TotalSize        int64  `json:"totalSize"` // Total file size in bytes
	ChunkSize        int    `json:"chunkSize"` // Size of this chunk
	Offset           int64  `json:"offset"`    // Current offset
	HasMore          bool   `json:"hasMore"`   // Whether there's more data
	ErrorMessage     string `json:"errorMessage,omitempty"`
}

NetworkConversationDataResponse contains the raw conversation data for a network-layer connection

type NetworkInterfaceInfo 

type NetworkInterfaceInfo struct {
	Index        int      `json:"index"`
	Name         string   `json:"name"`
	Flags        string   `json:"flags"`
	HardwareAddr string   `json:"hardwareAddr"`
	MTU          int      `json:"mtu"`
	Addrs        []string `json:"addrs"`
}

NetworkInterfaceInfo represents a network interface

type PortInfo 

type PortInfo struct {
	Port     int32  `json:"port"`
	Protocol string `json:"protocol"`
	Packets  uint64 `json:"packets"`
	Bytes    uint64 `json:"bytes"`
}

PortInfo represents port statistics

type PortMapping added in v0.9.1 

type PortMapping struct {
	Port        int    `json:"port"`
	MessageType string `json:"messageType"`
}

PortMapping represents a port-to-message-type mapping.

type ProcessingStats 

type ProcessingStats struct {
	CurrentFile      string  `json:"currentFile"`
	FileIndex        int     `json:"fileIndex"`
	TotalFiles       int     `json:"totalFiles"`
	PacketsProcessed int64   `json:"packetsProcessed"`
	TotalPackets     int64   `json:"totalPackets"`
	ProgressPercent  float64 `json:"progressPercent"`
	PacketsPerSecond int64   `json:"packetsPerSecond"`
	ProfilesCount    int     `json:"profilesCount"`
	ServicesCount    int     `json:"servicesCount"`
	LastUpdate       int64   `json:"lastUpdate"`

	// Service mode specific fields
	QueueLength   int   `json:"queueLength"`   // Number of jobs waiting in queue
	JobsScheduled int64 `json:"jobsScheduled"` // Total jobs scheduled
	JobsProcessed int64 `json:"jobsProcessed"` // Total jobs completed
}

ProcessingStats represents live processing statistics

type ProgressInfo 

type ProgressInfo struct {
	SessionID       string  `json:"sessionId"`
	Status          string  `json:"status"`
	ProgressPercent float64 `json:"progressPercent"`
	Message         string  `json:"message"`
	ErrorMessage    string  `json:"errorMessage,omitempty"`
}

ProgressInfo represents the progress of an analysis job

type ProtoMessagesResponse added in v0.9.1 

type ProtoMessagesResponse struct {
	Messages []pb.MessageInfo `json:"messages"`
}

ProtoMessagesResponse is the response for GET /api/proto/messages.

type ProtoStatusResponse added in v0.9.1 

type ProtoStatusResponse struct {
	Loaded           bool          `json:"loaded"`
	FileCount        int           `json:"fileCount"`
	MessageCount     int           `json:"messageCount"`
	SearchPaths      []string      `json:"searchPaths"`
	ShowAlternatives bool          `json:"showAlternatives"`
	PortMappings     []PortMapping `json:"portMappings"`
	Errors           []string      `json:"errors"`
	LastCompiled     string        `json:"lastCompiled"`
}

ProtoStatusResponse is the response for GET /api/proto/status.

type ProtocolHierarchyNode 

type ProtocolHierarchyNode struct {
	Name     string                  `json:"name"`
	Layer    string                  `json:"layer"`
	Count    int64                   `json:"count"`
	Bytes    int64                   `json:"bytes"`
	Children []ProtocolHierarchyNode `json:"children"`
}

ProtocolHierarchyNode represents a node in the protocol hierarchy

type ProtocolHierarchyResponse 

type ProtocolHierarchyResponse struct {
	Basis       string                   `json:"basis"`
	Limitations []string                 `json:"limitations"`
	Links       []SankeyLink             `json:"links"`
	Nodes       []string                 `json:"nodes"`
	Stats       map[string]ProtocolStats `json:"stats"`
}

ProtocolHierarchyResponse is the API response

type ProtocolInfo 

type ProtocolInfo struct {
	Name     string `json:"name"`
	Packets  uint64 `json:"packets"`
	Category string `json:"category"`
}

ProtocolInfo represents protocol statistics

type ProtocolStats 

type ProtocolStats struct {
	Count int64  `json:"count"`
	Bytes int64  `json:"bytes"`
	Layer string `json:"layer"`
}

ProtocolStats contains statistics for a protocol

type RenderedChartCoverage added in v0.16.0 

type RenderedChartCoverage struct {
	Basis            string `json:"basis"`
	Selection        string `json:"selection"`
	PointLimit       int    `json:"pointLimit"`
	RenderedValues   int    `json:"renderedValues"`
	ValuesKnown      bool   `json:"valuesKnown"`
	SourcesRequested int    `json:"sourcesRequested"`
	SourcesRead      int    `json:"sourcesRead"`
	AbsentSources    int    `json:"absentSources"`
	LimitReached     bool   `json:"limitReached"`
	TruncatedLabels  int    `json:"truncatedLabels"`
}

func (RenderedChartCoverage) Header added in v0.16.0 

func (c RenderedChartCoverage) Header() string

func (RenderedChartCoverage) Text added in v0.16.0 

func (c RenderedChartCoverage) Text() string

type ReportIssueRequest 

type ReportIssueRequest struct {
	SessionID   string `json:"sessionId"`
	Description string `json:"description"`
}

ReportIssueRequest represents the request body for reporting an issue

type ReportIssueResponse 

type ReportIssueResponse struct {
	Success bool   `json:"success"`
	IssueID string `json:"issueId"`
	Message string `json:"message"`
}

ReportIssueResponse represents the response for reporting an issue

type ResolveAlertRequest 

type ResolveAlertRequest struct {
	AlertID string `json:"alertId"`
	GroupID string `json:"groupId"` // Optional: resolve entire group
}

ResolveAlertRequest represents a request to resolve an alert

type ResolveAlertResponse 

type ResolveAlertResponse struct {
	Success     bool     `json:"success"`
	Message     string   `json:"message"`
	ResolvedAt  int64    `json:"resolvedAt"`
	ResolvedIDs []string `json:"resolvedIds,omitempty"` // IDs that were resolved
}

ResolveAlertResponse represents the response to a resolve request

type ResolvedAlert 

type ResolvedAlert struct {
	AlertID    string `json:"alertId"`
	ResolvedAt int64  `json:"resolvedAt"`
}

ResolvedAlert represents a resolved alert entry

type ResolvedAlertsStore 

type ResolvedAlertsStore struct {
	Alerts map[string]ResolvedAlert `json:"alerts"` // Map of alertId -> ResolvedAlert
}

ResolvedAlertsStore manages the resolved alerts

type ResponseActionAPI 

type ResponseActionAPI struct {
	Type    string         `json:"type"`
	Config  map[string]any `json:"config,omitempty"`
	Enabled *bool          `json:"enabled,omitempty"`
}

ResponseActionAPI represents a response action for the API

type RuleExecResult 

type RuleExecResult struct {
	RuleName      string `json:"ruleName"`
	AlertsCount   int    `json:"alertsCount"`
	RecordsRead   int    `json:"recordsRead"`
	Success       bool   `json:"success"`
	Error         string `json:"error,omitempty"`
	ExecutionTime int64  `json:"executionTimeMs"`
}

RuleExecResult represents the result of executing a single rule

type RuleResponse 

type RuleResponse struct {
	ID                string   `json:"id"`
	Name              string   `json:"name"`
	Description       string   `json:"description"`
	Type              string   `json:"type"`
	Expression        string   `json:"expression"`
	Severity          string   `json:"severity"`
	MITRE             []string `json:"mitre"`
	Tags              []string `json:"tags"`
	Enabled           bool     `json:"enabled"`
	Threshold         int      `json:"threshold,omitempty"`
	ThresholdWindow   int      `json:"thresholdWindow,omitempty"`
	DistinctField     string   `json:"distinctField,omitempty"`
	DistinctThreshold int      `json:"distinctThreshold,omitempty"`
	// Sequence is read-only here: the UI cannot author an ordered correlation
	// gate, but a gated rule must not be displayed as an ungated one.
	Sequence *rules.Sequence     `json:"sequence,omitempty"`
	Actions  []ResponseActionAPI `json:"actions,omitempty"`
}

RuleResponse represents a rule for the API

type RuleSetInfo 

type RuleSetInfo struct {
	Name         string `json:"name"`         // Filename without .yml extension
	Filename     string `json:"filename"`     // Full filename with extension
	RuleCount    int    `json:"ruleCount"`    // Number of rules in this set
	Enabled      bool   `json:"enabled"`      // Whether the rule set is enabled
	Description  string `json:"description"`  // Optional description from first rule or filename
	IsEmbedded   bool   `json:"isEmbedded"`   // Whether this is an embedded default rule set
	IsOverridden bool   `json:"isOverridden"` // Whether this embedded rule set has been overridden by a file
}

RuleSetInfo represents information about a rule set (YAML file)

type RuleSetsResponse 

type RuleSetsResponse struct {
	RuleSets []RuleSetInfo `json:"ruleSets"`
}

RuleSetsResponse represents the response with all rule sets

type RulesConfigResponse 

type RulesConfigResponse struct {
	Rules []RuleResponse `json:"rules"`
}

RulesConfigResponse represents the full rules configuration

type RuntimeConfig 

type RuntimeConfig struct {
	Behavior *BehaviorOptions
	// Features holds startup state of optional features by name; a missing
	// name means enabled. See features.go.
	Features      map[string]bool
	EvidenceLinks *evidencelink.Config
	// Branding
	LogoSubText string // Custom label shown below NETCAP logo (overrides LOCAL/SERVICE)

	// Input/Output
	Compress bool
	Buffer   bool

	// Performance
	Workers      int
	PacketBuffer int
	MemBufSize   int

	// Network Capture
	Interface   string
	PromiscMode bool
	SnapLen     int

	// Decoders
	BaseLayer     string
	DecodeOptions string
	Payload       bool
	Context       bool

	// Database/Enrichment
	MacDB        bool
	ServiceDB    bool
	GeoDB        bool
	GeoProviders string
	ReverseDNS   bool
	LocalDNS     bool

	// TCP Reassembly
	ReassembleConnections      bool
	FlowExports                bool
	CaptureEvidence            bool
	RetainPackets              bool
	PacketSegmentBytes         int64
	PacketRetentionBytes       int64
	FlowExportPorts            string
	FlushEvery                 int
	Checksum                   bool
	NoOptCheck                 bool
	IgnoreFSMErr               bool
	AllowMissingInit           bool
	ModbusRTUEndpoints         string
	DNP3PointMap               string
	ClosePendingTimeout        time.Duration
	CloseInactiveTimeout       time.Duration
	LiveMaintenanceInterval    time.Duration
	LiveFlushInterval          time.Duration
	MaxRetainedTCPBytes        int64
	MaxRetainedReassemblyBytes int64
	IncrementalHTTP            bool
	MaxRetainedTCPStateBytes   int64
	CaptureTimeIdleExpiry      bool

	// Output Format
	Proto bool
	JSON  bool
	CSV   bool

	// Elastic
	Elastic      bool
	ElasticAddrs string
	ElasticUser  string

	// Advanced
	IgnoreUnknown     bool
	FreeOSMemory      int
	ConnFlushInterval int
	ConnTimeout       time.Duration
	FlowFlushInterval int
	FlowTimeout       time.Duration

	// Stream processing
	Entropy    bool
	TCPDebug   bool
	SaveConns  bool
	DefragIPv4 bool
	HexDump    bool
	BannerSize int
}

RuntimeConfig holds the actual runtime configuration values passed from the capture package This allows the webUI to display the actual values the application was started with 

type SankeyLink struct {
	Source string `json:"source"`
	Target string `json:"target"`
	Value  int64  `json:"value"`
}

SankeyLink represents a link for Sankey diagram

type SecretSummary added in v0.9.1 

type SecretSummary struct {
	Timestamp int64  `json:"timestamp"`
	Service   string `json:"service"`
	Flow      string `json:"flow"`
	User      string `json:"user"`
	Password  string `json:"password"`
	Notes     string `json:"notes"`
	// Hash-based credentials
	Hash          string `json:"hash"`
	HashType      string `json:"hashType"`
	Domain        string `json:"domain"`
	Realm         string `json:"realm"`
	Challenge     string `json:"challenge"`
	ServiceName   string `json:"serviceName"`
	Etype         int32  `json:"etype"`
	HashcatFormat string `json:"hashcatFormat"`
	// HTTP Digest specific
	Method string `json:"method"`
	Nonce  string `json:"nonce"`
	Uri    string `json:"uri"`
	Qop    string `json:"qop"`
	Nc     string `json:"nc"`
	Cnonce string `json:"cnonce"`
	// NTLM specific
	Workstation string `json:"workstation"`
	LmHash      string `json:"lmHash"`
	NtHash      string `json:"ntHash"`
	// Authentication result tracking
	AuthSuccess    bool  `json:"authSuccess"`
	AuthSuccessSet bool  `json:"authSuccessSet"`
	AuthAttempts   int32 `json:"authAttempts"`
	// RADIUS specific
	MacAddress    string `json:"macAddress"`
	FramedAddress string `json:"framedAddress"`
	ConnectInfo   string `json:"connectInfo"`
	ReplyMessage  string `json:"replyMessage"`
	// SOCKS specific
	SocksVersion int32  `json:"socksVersion"`
	SocksStatus  string `json:"socksStatus"`
	// SIP specific
	SipMethod string `json:"sipMethod"`
	SipCallId string `json:"sipCallId"`
	SipFrom   string `json:"sipFrom"`
	SipTo     string `json:"sipTo"`
	// Community ID for cross-tool correlation
	CommunityID string `json:"communityId"`
}

SecretSummary represents a captured credential

type SecretsResponse added in v0.9.1 

type SecretsResponse struct {
	Secrets    []SecretSummary `json:"secrets"`
	TotalCount int             `json:"totalCount"`
}

SecretsResponse contains the list of credentials

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server represents the web UI HTTP server

func NewServer 

func NewServer(addr, outDir string, inputFiles []string, assetsPath string, debugLogging bool, dpiConfigured bool, isServiceMode bool, serviceConfig *ServiceConfig, runtimeConfig *RuntimeConfig, devMode bool) *Server

NewServer creates a new web UI server

func (*Server) AddInputFile 

func (s *Server) AddInputFile(filePath string)

AddInputFile adds a new input file to be processed (for "Open With" functionality on macOS) This creates a session and queues a job for the file

func (*Server) GetCompletedFiles 

func (s *Server) GetCompletedFiles() map[string]bool

GetCompletedFiles returns a copy of the completed files map

func (*Server) GetDPIPreferences 

func (s *Server) GetDPIPreferences(userIP string) *UserDPIPreferences

GetDPIPreferences retrieves DPI preferences for a user

func (*Server) GetDebugLogging 

func (s *Server) GetDebugLogging() bool

GetDebugLogging returns the current debug logging state

func (*Server) GetFileError 

func (s *Server) GetFileError(inputFile string) (FileError, bool)

GetFileError returns the error for a specific file, if any

func (*Server) GetFileOutputDir 

func (s *Server) GetFileOutputDir(inputFile string) (string, bool)

GetFileOutputDir retrieves the output directory for a specific input file

func (*Server) GetFileProcessingTime 

func (s *Server) GetFileProcessingTime(inputFile string) (float64, bool)

GetFileProcessingTime retrieves the processing time for a specific input file

func (*Server) GetOutputDir 

func (s *Server) GetOutputDir() string

GetOutputDir returns the current output directory

func (*Server) GetPayloadCapture 

func (s *Server) GetPayloadCapture() bool

GetPayloadCapture returns the current payload capture state

func (*Server) GetURL 

func (s *Server) GetURL() string

GetURL returns the full URL of the web UI

func (*Server) IsFileCompleted 

func (s *Server) IsFileCompleted(inputFile string) bool

IsFileCompleted checks if a file has completed processing

func (*Server) IsLiveMode 

func (s *Server) IsLiveMode() bool

IsLiveMode returns whether the server is in live capture mode

func (*Server) IsProcessing 

func (s *Server) IsProcessing() bool

IsProcessing includes admitted capture, queued analysis, and post-processing work.

func (*Server) MarkFileCompleted 

func (s *Server) MarkFileCompleted(inputFile string)

MarkFileCompleted marks a specific input file as completed

func (*Server) SetCollector 

func (s *Server) SetCollector(collector CollectorInterface)

SetCollector sets the collector reference for runtime configuration changes

func (*Server) SetDPIPreferences 

func (s *Server) SetDPIPreferences(userIP string, prefs *UserDPIPreferences)

SetDPIPreferences sets DPI preferences for a user

func (*Server) SetDebugLogging 

func (s *Server) SetDebugLogging(enabled bool)

SetDebugLogging sets the debug logging state

func (*Server) SetFileBPFFilter 

func (s *Server) SetFileBPFFilter(inputFile, bpfFilter string)

SetFileBPFFilter stores the BPF filter used for a specific input file

func (*Server) SetFileError 

func (s *Server) SetFileError(inputFile, errorMsg, errorLogPath string)

SetFileError records an error for a specific file

func (*Server) SetFileOutputDir 

func (s *Server) SetFileOutputDir(inputFile, outputDir string)

SetFileOutputDir stores the actual output directory for a specific input file and updates the active output directory to point to this location

func (*Server) SetFileProcessingTime 

func (s *Server) SetFileProcessingTime(inputFile string, durationSeconds float64)

SetFileProcessingTime stores the processing time for a specific input file

func (*Server) SetLiveMode 

func (s *Server) SetLiveMode(isLive bool)

SetLiveMode sets whether the server is in live capture mode

func (*Server) SetPayloadCapture 

func (s *Server) SetPayloadCapture(enabled bool)

SetPayloadCapture sets the payload capture state for future analysis

func (*Server) SetProcessingComplete 

func (s *Server) SetProcessingComplete()

SetProcessingComplete finishes the external capture without hiding queued work.

func (*Server) SetProcessingStarted added in v0.15.4 

func (s *Server) SetProcessingStarted()

SetProcessingStarted marks an externally managed CLI capture as active.

func (*Server) SetStopCapture 

func (s *Server) SetStopCapture(cancel context.CancelFunc)

SetStopCapture sets the cancel function for stopping live capture

func (*Server) SetUploadCallback 

func (s *Server) SetUploadCallback(callback UploadCallbackFunc)

SetUploadCallback sets the callback function for file uploads

func (*Server) Start 

func (s *Server) Start() error

Start starts the HTTP server in a goroutine

func (*Server) Stop 

func (s *Server) Stop(ctx context.Context) error

Stop gracefully stops the HTTP server

func (*Server) UpdateOutputDir 

func (s *Server) UpdateOutputDir(outDir string)

UpdateOutputDir updates the output directory (useful for multi-file processing)

func (*Server) UpdateProcessingStats 

func (s *Server) UpdateProcessingStats(stats ProcessingStats)

UpdateProcessingStats updates the live processing statistics

type ServiceConfig 

type ServiceConfig struct {
	DataDir               string
	PreloadDir            string
	MaxFileSize           int64
	MaxAnalysisHour       int
	SessionExpiry         int
	CleanupInterval       int
	MaxStorageBytes       int64
	MaxIssueReportsPerDay int  // Maximum number of issue reports per IP per day
	PreloadLargestN       int  // Load only the N largest files from pcaps folder (0 = all files)
	EnforceMaxSizePreload bool // Enforce service max file size for preloaded pcaps
}

ServiceConfig holds the service mode configuration

func DefaultServiceConfig 

func DefaultServiceConfig() *ServiceConfig

DefaultServiceConfig returns the default service configuration

type ServiceSummary 

type ServiceSummary struct {
	Timestamp            int64    `json:"timestamp"`
	IP                   string   `json:"ip"`
	Port                 int32    `json:"port"`
	Name                 string   `json:"name"`
	Banner               string   `json:"banner"`
	Protocol             string   `json:"protocol"`
	NumFlows             int      `json:"numFlows"`
	Product              string   `json:"product"`
	Vendor               string   `json:"vendor"`
	Version              string   `json:"version"`
	Notes                string   `json:"notes"`
	BytesServer          int32    `json:"bytesServer"`
	BytesClient          int32    `json:"bytesClient"`
	Hostname             string   `json:"hostname"`
	OS                   string   `json:"os"`
	Applications         []string `json:"applications"`
	PortName             string   `json:"portName"`
	DetectedProtocolName string   `json:"detectedProtocolName"`
	MatchedProbeID       string   `json:"matchedProbeID"`
}

ServiceSummary represents aggregated information for a single service

type ServicesResponse 

type ServicesResponse struct {
	Services   []ServiceSummary `json:"services"`
	TotalCount int              `json:"totalCount"`
}

ServicesResponse contains the list of services

type SessionInfo 

type SessionInfo struct {
	SessionID        string                `json:"sessionId"`
	ParentSessionID  string                `json:"parentSessionId,omitempty"`
	ParentRunID      string                `json:"parentRunId,omitempty"`
	AnalysisSelector string                `json:"analysisSelector,omitempty"`
	PacketSelection  *childPacketSelection `json:"packetSelection,omitempty"`
	IP               string                `json:"ip"`
	UploadTimestamp  time.Time             `json:"uploadTimestamp"`
	InputFile        string                `json:"inputFile"`
	InputFilename    string                `json:"inputFilename"`
	InputFileSize    int64                 `json:"inputFileSize"`
	OutputDir        string                `json:"outputDir"`
	Status           SessionStatus         `json:"status"`
	ErrorMessage     string                `json:"errorMessage,omitempty"`
	ErrorLogPath     string                `json:"errorLogPath,omitempty"` // Path to detailed error log file
	StartTime        time.Time             `json:"startTime"`
	CompletionTime   time.Time             `json:"completionTime"`
	ProcessingTime   float64               `json:"processingTime,omitempty"` // Processing duration in seconds
	PacketsTotal     int64                 `json:"packetsTotal,omitempty"`
	ResultsReady     bool                  `json:"resultsReady"`
	ShareUrl         string                `json:"shareUrl"`         // Shareable URL for viewing this session
	IsPreloaded      bool                  `json:"isPreloaded"`      // True if this is a preloaded system pcap
	BPFFilter        string                `json:"bpfFilter"`        // BPF filter applied during capture
	IncludeDecoders  string                `json:"includeDecoders"`  // Decoders included during capture
	ExcludeDecoders  string                `json:"excludeDecoders"`  // Decoders excluded during capture
	HasReportedIssue bool                  `json:"hasReportedIssue"` // True if an issue has been reported for this session
}

SessionInfo tracks information about an upload and analysis session

type SessionManager 

type SessionManager struct {
	// contains filtered or unexported fields
}

SessionManager manages all active sessions and IP tracking

func NewSessionManager 

func NewSessionManager(maxAnalysisHour, sessionExpiryMin, maxIssueReportsPerDay int) *SessionManager

NewSessionManager creates a new session manager

func (*SessionManager) AddSession 

func (sm *SessionManager) AddSession(session *SessionInfo)

AddSession adds a new session and tracks it for the IP

func (*SessionManager) CheckIssueReportLimit 

func (sm *SessionManager) CheckIssueReportLimit(ip string) (allowed bool, remaining int)

CheckIssueReportLimit checks if an IP has exceeded the issue report rate limit (3 per hour)

func (*SessionManager) CheckRateLimit 

func (sm *SessionManager) CheckRateLimit(ip string) (allowed bool, remaining int)

CheckRateLimit checks if an IP has exceeded the rate limit

func (*SessionManager) CleanupExpiredSessions 

func (sm *SessionManager) CleanupExpiredSessions() []string

CleanupExpiredSessions removes expired sessions and their data

func (*SessionManager) DeleteSession added in v0.15.4 

func (sm *SessionManager) DeleteSession(sessionID string) *SessionInfo

DeleteSession removes one session from the manager and (optionally) from the IP tracker. Returns the removed *SessionInfo or nil if the id wasn't found. Caller is responsible for removing on-disk artefacts (uploads/<sid>, results/<sid>); see Server.deleteSessionArtefacts.

func (*SessionManager) GetAccessibleSessions added in v0.15.4 

func (sm *SessionManager) GetAccessibleSessions(ip string) []*SessionInfo

GetAccessibleSessions returns the sessions a given client may read: its own, plus the preloaded system pcaps that are published to everyone.

Use this, not GetAllSessions, for anything that serves data derived from capture files. GetAllSessions ignores ownership, and in service mode the uploads it exposes belong to other visitors -- netcap extracts credentials, DNS queries, certificates and files out of them. Two aggregation paths (the dashboard's "All PCAPs" chart scope and the global geolocation chart) used GetAllSessions and so mixed every visitor's capture into one view.

The ownership test is the same one handleListInputFiles applies: match on IP, or accept the session if it is flagged preloaded.

func (*SessionManager) GetAllSessions 

func (sm *SessionManager) GetAllSessions() []*SessionInfo

GetAllSessions returns all sessions (for debugging/monitoring)

func (*SessionManager) GetSession 

func (sm *SessionManager) GetSession(sessionID string) (*SessionInfo, bool)

GetSession retrieves a session by ID

func (*SessionManager) GetSessionForIP 

func (sm *SessionManager) GetSessionForIP(sessionID, ip string) (*SessionInfo, bool)

GetSessionForIP checks if a session belongs to a specific IP

func (*SessionManager) GetSessionsForIP 

func (sm *SessionManager) GetSessionsForIP(ip string) []*SessionInfo

GetSessionsForIP returns all sessions for a specific IP

func (*SessionManager) GetStorageUsageForIP 

func (sm *SessionManager) GetStorageUsageForIP(ip string) int64

GetStorageUsageForIP calculates storage usage for a specific IP This includes both the user's own sessions and preloaded/system pcaps

func (*SessionManager) MarkSessionIssueReported 

func (sm *SessionManager) MarkSessionIssueReported(sessionID string)

MarkSessionIssueReported marks a session as having an issue reported

func (*SessionManager) RecordIssueReport 

func (sm *SessionManager) RecordIssueReport(ip string)

RecordIssueReport records an issue report for an IP

func (*SessionManager) RestoreSessionsFromDisk 

func (sm *SessionManager) RestoreSessionsFromDisk(resultsDir, pcapsDir, uploadsDir string) error

RestoreSessionsFromDisk scans the results directory and restores session information This allows sessions to persist across server restarts

func (*SessionManager) SaveSessionMetadata 

func (sm *SessionManager) SaveSessionMetadata(sessionID string) error

SaveSessionMetadata is a public method to save session metadata Call this after creating or updating a session to persist it to disk

func (*SessionManager) UpdateSessionPacketCount 

func (sm *SessionManager) UpdateSessionPacketCount(sessionID string, count int64)

UpdateSessionPacketCount updates the packet count for a session

func (*SessionManager) UpdateSessionProcessingTime 

func (sm *SessionManager) UpdateSessionProcessingTime(sessionID string, durationSeconds float64)

UpdateSessionProcessingTime updates the processing time for a session

func (*SessionManager) UpdateSessionStatus 

func (sm *SessionManager) UpdateSessionStatus(sessionID string, status SessionStatus, errorMsg string, errorLogPath string)

UpdateSessionStatus updates the status of a session

type SessionStatus 

type SessionStatus string

SessionStatus represents the current status of an analysis session 

const (
	StatusQueued     SessionStatus = "queued"
	StatusProcessing SessionStatus = "processing"
	StatusCompleted  SessionStatus = "completed"
	StatusFailed     SessionStatus = "failed"
)

type SoftwareInfo 

type SoftwareInfo struct {
	Product      string   `json:"product"`
	Vendor       string   `json:"vendor"`
	Version      string   `json:"version"`
	Flows        []string `json:"flows"`
	CommunityIDs []string `json:"communityIds"` // Community IDs for cross-tool correlation
}

SoftwareInfo contains software details including flows and community IDs

type SoftwareObservation added in v0.16.0 

type SoftwareObservation struct {
	Host                    string `json:"host"`
	Role                    string `json:"role"`
	TimestampNs             string `json:"timestampNs"`
	VulnerabilityAssessment string `json:"vulnerabilityAssessment"`
}

type SoftwareResponse 

type SoftwareResponse struct {
	Software   []SoftwareSummary `json:"software"`
	TotalCount int               `json:"totalCount"`
}

SoftwareResponse contains the list of software

type SoftwareSummary 

type SoftwareSummary struct {
	Observations       []SoftwareObservation `json:"observations"`
	ObservationsCapped bool                  `json:"observationsCapped"`
	Product            string                `json:"product"`
	Vendor             string                `json:"vendor"`
	Version            string                `json:"version"`
	OS                 string                `json:"os"`
	Count              int                   `json:"count"`
	Devices            []string              `json:"devices"`
	Services           []string              `json:"services"`
	DPIResults         []string              `json:"dpiResults"`
	FirstSeen          int64                 `json:"firstSeen"`
	LastSeen           int64                 `json:"lastSeen"`
	SourceNames        []string              `json:"sourceNames"`
	Flows              []string              `json:"flows"`
	// Detection context
	DetectionMethod string `json:"detectionMethod"`
	ConfidenceLevel string `json:"confidenceLevel"`
	// Behavioral fingerprint
	BehaviorProfile string `json:"behaviorProfile"`
	IsHeadless      bool   `json:"isHeadless"`
	IsEmulated      bool   `json:"isEmulated"`
	IsAutomated     bool   `json:"isAutomated"`
	// Risk indicators
	HasKnownVulnerabilities bool   `json:"hasKnownVulnerabilities"`
	IsEndOfLife             bool   `json:"isEndOfLife"`
	SupportStatus           string `json:"supportStatus"`
	// Community ID v1 for cross-tool correlation (Zeek, Suricata, etc.)
	CommunityIDs []string `json:"communityIds"`
}

SoftwareSummary represents aggregated information for software

type StatsResponse 

type StatsResponse struct {
	ProcessingStats ProcessingStats      `json:"processingStats"`
	FileErrors      map[string]FileError `json:"fileErrors"`
}

StatsResponse represents the processing statistics response

type StatusResponse 

type StatusResponse struct {
	ChildAnalysisVersion int       `json:"childAnalysisVersion"`
	IsProcessing         bool      `json:"isProcessing"`
	OutputDir            string    `json:"outputDir"`
	InputFiles           []string  `json:"inputFiles"`
	ServerStarted        time.Time `json:"serverStarted"`
	ActiveInputFile      string    `json:"activeInputFile"`
	IsMultiFile          bool      `json:"isMultiFile"`
	IsServiceMode        bool      `json:"isServiceMode,omitempty"`
	IsLiveMode           bool      `json:"isLiveMode"`
	SessionID            string    `json:"sessionId,omitempty"`   // Current session ID (service mode only)
	LogoSubText          string    `json:"logoSubText,omitempty"` // Custom label shown below NETCAP logo
}

StatusResponse represents the capture status

type SystemInfo 

type SystemInfo struct {
	NumCPU       int    `json:"numCPU"`
	NumGoroutine int    `json:"numGoroutine"`
	TotalMemory  uint64 `json:"totalMemory"`
	FreeMemory   uint64 `json:"freeMemory"`
	UsedMemory   uint64 `json:"usedMemory"`
	GOOS         string `json:"goos"`
	GOARCH       string `json:"goarch"`
}

SystemInfo represents system hardware information

type ToggleInjectionRuleRequest 

type ToggleInjectionRuleRequest struct {
	Enabled bool `json:"enabled"`
}

ToggleInjectionRuleRequest represents a request to toggle a rule's enabled state

type UpdateInjectionRuleRequest 

type UpdateInjectionRuleRequest struct {
	Name         string         `json:"name"`
	Description  string         `json:"description"`
	Type         string         `json:"type"`
	Expression   string         `json:"expression"`
	Action       string         `json:"action"`
	ActionConfig map[string]any `json:"actionConfig,omitempty"`
	Enabled      bool           `json:"enabled"`
	Priority     int            `json:"priority,omitempty"`
	StopOnMatch  bool           `json:"stopOnMatch,omitempty"`
	Tags         []string       `json:"tags,omitempty"`
}

UpdateInjectionRuleRequest represents a request to update an injection rule

type UpdateRuleRequest 

type UpdateRuleRequest struct {
	Name              string              `json:"name"`
	Description       string              `json:"description"`
	Type              string              `json:"type"`
	Expression        string              `json:"expression"`
	Severity          string              `json:"severity"`
	MITRE             []string            `json:"mitre"`
	Tags              []string            `json:"tags"`
	Enabled           bool                `json:"enabled"`
	Threshold         int                 `json:"threshold,omitempty"`
	ThresholdWindow   int                 `json:"thresholdWindow,omitempty"`
	DistinctField     string              `json:"distinctField,omitempty"`
	DistinctThreshold int                 `json:"distinctThreshold,omitempty"`
	Actions           []ResponseActionAPI `json:"actions,omitempty"`
}

UpdateRuleRequest represents a request to update a rule

type UpdateRuleSetRequest 

type UpdateRuleSetRequest struct {
	Enabled bool `json:"enabled"`
}

UpdateRuleSetRequest represents a request to enable/disable a rule set

type UploadCallbackFunc 

type UploadCallbackFunc func(filePath string) error

UploadCallbackFunc is called when files are uploaded via the web UI

type UserDPIPreferences 

type UserDPIPreferences struct {
	EnabledModules []string  `json:"enabledModules"`
	LastUpdated    time.Time `json:"lastUpdated"`
}

UserDPIPreferences represents user-specific DPI module preferences

type VulnerabilitiesResponse 

type VulnerabilitiesResponse struct {
	KEVStatus       string                     `json:"kevStatus"`
	Vulnerabilities []VulnerabilitySummary     `json:"vulnerabilities"`
	Exploits        []ExploitSummary           `json:"exploits"`
	AffectedHosts   []HostVulnerabilitySummary `json:"affectedHosts"`
	TotalVulns      int                        `json:"totalVulns"`
	TotalExploits   int                        `json:"totalExploits"`
}

VulnerabilitiesResponse contains the aggregated data

type VulnerabilitySummary 

type VulnerabilitySummary struct {
	KEV          *enrichment.KEVStatus `json:"kev,omitempty"`
	References   []vulndb.Reference    `json:"references"`
	ID           string                `json:"id"`
	Description  string                `json:"description"`
	Severity     string                `json:"severity"`
	V2Score      string                `json:"v2Score"`
	AccessVector string                `json:"accessVector"`
	Versions     []string              `json:"versions"`
	Count        int                   `json:"count"`
	Software     *SoftwareInfo         `json:"software"`     // Software details including flows
	Affected     int                   `json:"affected"`     // Number of affected hosts
	CommunityIDs []string              `json:"communityIds"` // Community IDs for cross-tool correlation
}

VulnerabilitySummary represents aggregated vulnerability information

type YaraRuleInfo 

type YaraRuleInfo struct {
	Name        string `json:"name"`
	Filename    string `json:"filename"`
	Size        int64  `json:"size"`
	Enabled     bool   `json:"enabled"`
	ModifiedAt  int64  `json:"modifiedAt"`
	RuleCount   int    `json:"ruleCount"`
	Description string `json:"description"`
}

YaraRuleInfo represents metadata about a YARA rule file.

type YaraScanResponse 

type YaraScanResponse struct {
	State        string           `json:"state"`
	Failed       int              `json:"failed"`
	Results      []YaraScanResult `json:"results"`
	TotalFiles   int              `json:"totalFiles"`
	FilesScanned int              `json:"filesScanned"`
	TotalMatches int              `json:"totalMatches"`
	ScanTimeMs   int64            `json:"scanTimeMs"`
}

YaraScanResponse represents the response from a YARA scan operation.

type YaraScanResult 

type YaraScanResult struct {
	State      string   `json:"state"`
	Outcome    string   `json:"outcome,omitempty"`
	Error      string   `json:"error,omitempty"`
	FilePath   string   `json:"filePath"`
	FileName   string   `json:"fileName"`
	Matches    []string `json:"matches"`
	ScanTimeMs int64    `json:"scanTimeMs"`
}

YaraScanResult represents a YARA scan result for a single file.

type YaraStatusResponse 

type YaraStatusResponse struct {
	Available    bool   `json:"available"`
	RulesDir     string `json:"rulesDir"`
	EnabledRules int    `json:"enabledRules"`
	TotalRules   int    `json:"totalRules"`
}

YaraStatusResponse represents the YARA subsystem status.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.
⌂ 换网址