net.agent.conf

# NETCAP config for agent tool
# Generated by NETCAP v0.5.2
# You can regenerate an up to date default configuration with:
# 	$ net <tool> -gen-config > net.<tool>.conf

# specify the address and port of the collection server
addr 127.0.0.1:1335

# support streams without SYN/SYN+ACK/ACK sequence
allowmissinginit true

# select base layer
base ethernet

# supply a BPF filter to use for netcap collection
bpf 

# chunk size for internal data channels
chan-size 1024

# check TCP checksum
checksum false

# reassembly: close connections that are inactive after X
close-inactive-timeout 1h0m0s

# reassembly: close connections that have pending bytes after X
close-pending-timeout 1h0m0s

# read configuration from file at path
config 

# flush connections every X flows
conn-flush-interval 0

# close connections older than X seconds
conn-timeout 0s

# add packet flow context to selected audit records
context true

# display debug information
debug false

# show all available decoders
decoders false

# use DPI for device profiling
dpi false

# enable entropy calculation for Eth,IP,TCP and UDP payloads
entropy false

# exclude specific decoders
exclude 

# path to created extracted files (currently only for HTTP)
fileStorage 

# flushes flows every X flows
flow-flush-interval 0

# closes flows older than flowTimeout
flow-timeout 0s

# flush assembler every N packets
flushevery 100

# use geolocation for device profiling
geoDB false

# dump packets used in stream reassembly as hex to the reassembly.log file
hexdump false

# interface
iface en0

# ignore TCP FSM errors
ignorefsmerr true

# include specific decoders
include 

# list all visible network interfaces
interfaces false

# Defragment IPv4 packets
ip4defrag true

# use ja3 database for device profiling
ja3DB false

# resolve DNS locally via hosts file in the database dir
local-dns false

# enable verbose packet decoding error logging
log-errors false

# use mac to vendor database for device profiling
macDB false

# max size of packet
max 10240

# set size for membuf
membuf-size 12582912

# write memory profile
memprofile 

# do not check TCP options (useful to ignore MSS on captures with TSO)
nooptcheck true

# select decoding options
opts lazy

# capture payload for supported layers
payload false

# set packet buffer size
pbuf 0

# capture live in promisc mode
promisc true

# path to the hex encoded server public key on disk
pubkey 

# resolve ips to domains via the operating systems default dns resolver
reverse-dns false

# use serviceDB for device profiling
serviceDB false

# configure snaplen for live capture
snaplen 1514

# print netcap package version and exit
version false

# wait for all connections to finish processing before cleanup
wait-conns true

# number of workers
workers 12

# write incomplete response
writeincomplete false