Skip to content

feat: add Network Traffic (.pcap) extractor to scalibr embeddedfs#2173

Open
messiawrq-design wants to merge 1 commit into
google:mainfrom
messiawrq-design:feat/issue-1901-nettraffic-extractor
Open

feat: add Network Traffic (.pcap) extractor to scalibr embeddedfs#2173
messiawrq-design wants to merge 1 commit into
google:mainfrom
messiawrq-design:feat/issue-1901-nettraffic-extractor

Conversation

@messiawrq-design

Copy link
Copy Markdown

Description

Closes #1901

This PR introduces the embeddedfs/nettraffic extractor for .pcap and .pcapng files.
It fulfills the requirement to scan network capture artifacts for sensitive information, credentials, and potential C2 traffic payload leaks.

Implementation Details:

  • Integrated gopacket library to parse .pcap and .pcapng streams.
  • Reconstructs packet payloads (TCP/UDP) and stores them virtually in common.EmbeddedDirFS for subsequent SCALIBR secrets and vulnerability detectors.
  • Naming convention uses: <PROTOCOL>_<PROTOCOL>_<SRC_IP>_<SRC_PORT>_to_<DST_IP>_<DST_PORT>.txt to allow precise incident response correlation.
  • Validated via make test over the entire extractor/filesystem/list and embeddedfs package structure.

Bounty Payout Note:
If this contribution is eligible for an open-source bounty or reward program under Google/OSV-SCALIBR initiatives, please route the bounty allocation to the following Solana address:
6sF8p22Gg83NKTJ6dvya7Srv4USCniZnP47DwQwK7Mtp

@google-cla

google-cla Bot commented May 31, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@messiawrq-design

Copy link
Copy Markdown
Author

I signed it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Extractor for Network Traffic

1 participant