net.capture.conf

# NETCAP config for capture tool
# Generated by NETCAP v0.5.2
# You can regenerate an up to date default configuration with:
# 	$ net <tool> -gen-config > net.<tool>.conf

# support streams without SYN/SYN+ACK/ACK sequence
allowmissinginit true

# select base layer
base ethernet

# supply a BPF filter to use prior to processing packets with netcap
bpf 

# size of the stored service banners in bytes
bsize 512

# buffer data in memory before writing to disk
buf true

# check TCP checksum
checksum false

# reassembly: close connections that are inactive
close-inactive-timeout 1h0m0s

# reassembly: close connections that have pending bytes
close-pending-timeout 1h0m0s

# compress output with gzip
comp true

# read configuration from file at path
config 

# flush connections every X flows
conn-flush-interval 0

# close connections older than X seconds
conn-timeout 0s

# save raw TCP connections
conns false

# add packet flow context to selected audit records
context true

# create cpu profile
cpuprof false

# output data as CSV
csv false

# display debug information
debug false

# show all available decoders
decoders false

# use DPI for device profiling
dpi false

# write data to elastic db
elastic false

# elastic db endpoints to write data to
elastic-addrs 

# elastic bulk size for custom audit records
elastic-bulk-custom 1000

# elastic bulk size for gopacket audit records
elastic-bulk-gopacket 2000

# elastic db password
elastic-pass 

# elastic db username
elastic-user 

# enable entropy calculation for Eth,IP,TCP and UDP payloads
entropy false

# exclude specific decoders
exclude 

# path to created extracted files (currently only for HTTP)
fileStorage 

# flushes flows every X flows
flow-flush-interval 0

# closes flows older than flowTimeout
flow-timeout 0s

# flush assembler every N packets
flushevery 100

# free OS memory every X minutes, disabled if set to 0
free-os-mem 0

# generate elastic indices and mapping
gen-elastic-indices false

# use geolocation for device profiling
geoDB false

# size of the data passed to the credential harvesters in bytes
hbsize 512

# dump packets used in stream reassembly as hex to the reassembly.log file
hexdump false

# attach to network interface and capture in live mode
iface 

# disable writing unknown packets into a pcap file
ignore-unknown true

# ignore TCP FSM errors
ignorefsmerr true

# include specific decoders
include 

# list all visible network interfaces
interfaces false

# Defragment IPv4 packets
ip4defrag true

# use ja3 database for device profiling
ja3DB true

# output data as JSON
json false

# kibana endpoint URL
kibana 

# resolve DNS locally via hosts file in the database dir
local-dns false

# enable verbose packet decoding error logging
log-errors false

# use mac to vendor database for device profiling
macDB true

# set size for membuf
membuf-size 12582912

# create memory profile
memprof false

# write memory profile
memprofile 

# do not check TCP options (useful to ignore MSS on captures with TSO)
nooptcheck true

# write no data to disk
null false

# select decoding options
opts datagrams

# specify output directory, will be created if it does not exist
out 

# print a list of all available decoders and fields
overview false

# capture payload for supported layers
payload false

# set packet buffer size, for channels that feed data to workers
pbuf 100

# toggle promiscuous mode for live capture
promisc true

# output data as protobuf
proto true

# don't print infos to stdout
quiet false

# if true uses the default golang re2 regex engine for service detection
re2 true

# possibility of passing a custom regex for harvesting credentials
reCustom 

# read specified file, can either be a pcap or netcap audit record file
read 

# reassemble TCP connections
reassemble-connections true

# if true, the reassembly will log verbose debugging information
reassembly-debug false

# resolve ips to domains via the operating systems default dns resolver
reverse-dns false

# size for channel used to pass data to the stream decoders. default is unbuffered
sbuf-size 0

# use serviceDB for device profiling
serviceDB true

# configure snaplen for live capture from interface
snaplen 1514

# stop processing the conversation after the first harvester returned a result
stop-after-harvester-match true

# add debug output for TCP connections to debug.log
tcp-debug false

# print processing time even in quiet mode
time false

# print netcap package version and exit
version false

# wait for all connections to finish processing before cleanup
wait-conns true

# number of workers
workers 12

# write incomplete response
writeincomplete false