A high-performance packet capture solution that buffers all network traffic to disk for fast retrieval of specific subsets.
Stenographer is a full-packet-capture solution that buffers all network traffic to disk for security monitoring purposes. It's designed to capture packets at very high speeds while managing disk space automatically, then provide fast access to specific subsets of packets for intrusion detection and incident response investigations.
Security analysts, network engineers, and incident response teams who need to capture and quickly query network traffic for forensic analysis and threat detection.
Developers choose Stenographer for its exceptional performance in high-speed packet capture and efficient disk management, combined with a simple query interface that enables rapid retrieval of specific traffic subsets without the overhead of complex packet processing.
Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Can write packets at speeds up to ~10Gbps on multi-core, multi-disk machines, making it suitable for high-volume network monitoring as described in the README.
Automatically deletes oldest packets when disk limits are reached, ensuring continuous capture without manual intervention, which is critical for long-term security logging.
Quickly reads small subsets (<1%) of stored packets based on analyst queries, ideal for incident response where speed is paramount.
Uses a subset of BPF with time-based filters, allowing analysts to specify packet subsets easily without complex syntax, as detailed in the Query Language section.
Stenoread CLI automates packet retrieval and passes data to tcpdump for advanced filtering and output formatting, enhancing flexibility for security workflows.
Explicitly not designed for complex processing like TCP stream reassembly, limiting analysis to raw packet capture and requiring complementary tools for deeper insights.
Reading back large amounts (>1%) of packets is discouraged due to disk read-write competition, as admitted in the README, making it unsuitable for data-heavy extractions.
Requires installing specific packages (e.g., libaio-dev) and building with Go, which can be non-trivial and time-consuming compared to drop-in solutions.
Query language lacks features like hostname resolution or advanced BPF primitives, restricting filtering capabilities for complex security investigations.