How iti/ics-security-tools works
This is a community collection of ICS security tools, not one integrated application. The clearest end-to-end workflow in the sampled code is Grassmarlin’s packet-import path: capture parsers produce packet/import data, a session dispatches imports, and graph UI components present network models. The tree also documents Grassmarlin capabilities for Bro, Cisco, CSV and live imports, fingerprinting, serialization and SVG export; these are represented as subsystems where implementation links were not sampled. Other tools are independent. Evidence is limited to the README, tree and cited source-index references or excerpts.
Main entry points: PcapFileParser.java PCAP parser · Session.java Session · ImportItem.java Import items · LogicalProcessor.java Logical processing
Components 21
Grassmarlin ingestion
- Session
tools/mirrored/grassmarlin/GM3/src/core/document/Session.java - Import items
tools/mirrored/grassmarlin/GM3/src/core/importmodule/ImportItem.java - PCAP parser
tools/mirrored/grassmarlin/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java - Offline PCAP
tools/mirrored/grassmarlin/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java - Other importers
tools/mirrored/grassmarlin/GM3/src/core/importmodule - Import pipeline
tools/mirrored/grassmarlin/GM3/src/core/importmodule/Pipeline.java
Analysis model
- Logical processing
tools/mirrored/grassmarlin/GM3/src/core/importmodule/LogicalProcessor.java - Packet data
tools/mirrored/grassmarlin/GM3/src/core/fingerprint/PacketData.java - Fingerprints
tools/mirrored/grassmarlin/GM3/src/core/fingerprint - Protocol decoding
tools/mirrored/grassmarlin/GM3/src/core/protocol - Network topology
tools/mirrored/grassmarlin/GM3/src/core/document/graph - Session serialization
tools/mirrored/grassmarlin/GM3/src/core/document/serialization
Visualization
- Graph views
tools/mirrored/grassmarlin/GM3/src/ui/graphing/Graph.java - Graph tree
tools/mirrored/grassmarlin/GM3/src/ui/graphing/GraphTreeController.java - Physical topology view
tools/mirrored/grassmarlin/GM3/src/ui/graphing/physical/PhysicalGraphTreeController.java - SVG export
tools/mirrored/grassmarlin/GM3/data/plugins/iadgov.svgexport
Other tools
- Serial capture conversion
tools/mirrored/serial2pcap/libserial2pcap.py - Serial reader
tools/mirrored/serial2pcap/Lib/SerialPortReader.py - SMOD Modbus
tools/mirrored/smod/System/Core/Modbus.py - Scapy shell
tools/mirrored/smod/System/Lib/scapy/main.py
Other components
- Analyst
Connections 18
- Analyst → Session: submits imports
- Session → Import items: accepts
tools/mirrored/grassmarlin/GM3/src/core/document/Session.java - Import items → PCAP parser: selects iterator
tools/mirrored/grassmarlin/GM3/src/core/importmodule/ImportItem.java - Import items → Import pipeline: keys iterators
tools/mirrored/grassmarlin/GM3/src/core/importmodule/ImportItem.java - PCAP parser → Packet data: creates packet data
tools/mirrored/grassmarlin/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java - Offline PCAP → Packet data: builds packet data
tools/mirrored/grassmarlin/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java - PCAP parser → Logical processing: queues hosts
tools/mirrored/grassmarlin/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java - Offline PCAP → Logical processing: references processor
tools/mirrored/grassmarlin/GM3/data/plugins/iadgov.offlinepcap/PacketHandler.java - Logical processing → Network topology: updates model
tools/mirrored/grassmarlin/GM3/src/core/importmodule/LogicalProcessor.java - Packet data → Fingerprints: provides packet fields
tools/mirrored/grassmarlin/GM3/src/core/fingerprint/PacketData.java - PCAP parser → Protocol decoding: decodes frames
tools/mirrored/grassmarlin/GM3/src/core/importmodule/inputIterators/pcap/PcapFileParser.java - Session → Session serialization: uses XML
tools/mirrored/grassmarlin/GM3/src/core/document/Session.java - Graph views → Network topology: wraps network graph
tools/mirrored/grassmarlin/GM3/src/ui/graphing/Graph.java - Graph tree → Graph views: extends graph controller
tools/mirrored/grassmarlin/GM3/src/ui/graphing/GraphTreeController.java - Physical topology view → Graph tree: extends controller
tools/mirrored/grassmarlin/GM3/src/ui/graphing/physical/PhysicalGraphTreeController.java - SVG export → Analyst: exports visualization
- Serial capture conversion → Serial reader: uses reader
tools/mirrored/serial2pcap/libserial2pcap.py - SMOD Modbus → Scapy shell: uses Scapy
tools/mirrored/smod/System/Core/Modbus.py