How vkg6835/signature-traffic-detector works
sigdetect is a command-line network-traffic detector: it loads threat indicators before reading a capture, parses packets into bidirectional conversations, extracts identifying fields, classifies each flow, and reports verdicts with a simulated IPS action. The graph includes the documented synthetic-capture generator as a separate optional capability. Main and feed orchestration are shown from the excerpts and README; some internal wiring is documented at module level rather than demonstrated in sampled call sites.
Main entry points: mod.rs Feed loading · main.rs CLI runner · flow.rs Flow assembly · detect.rs Detection engine
Components 21
Run orchestration
- Config and key
src/config.rs - CLI runner
src/main.rs
Threat intelligence
- Feed loading
src/feeds/mod.rs - URLhaus adapter
src/feeds/urlhaus.rs - ThreatFox adapter
src/feeds/threatfox.rs - Feed cache
src/feeds/mod.rs - Local indicators
data/local_rules.json - Offline signatures
data/offline_signatures.json - Signature set
src/ioc.rs
Traffic analysis
- PCAP reader
src/pcap.rs - Packet parser
src/packet.rs - Flow assembly
src/flow.rs - Protocol fields
src/appproto.rs
Classification and reporting
- Detection engine
src/detect.rs - Report output
src/report.rs
Synthetic capture
- Generator CLI
src/bin/gen_pcap.rs - Capture synthesis
src/synth.rs
Other components
- Operator
- PCAP file
- abuse.ch feeds
- JSON report
Connections 29
- Operator → CLI runner: runs
- CLI runner → Config and key: loads config
- CLI runner → Feed loading: loads indicators
- Config and key → Feed loading: provides key
- Feed loading → URLhaus adapter: fetches URLs
- Feed loading → ThreatFox adapter: fetches IOCs
- URLhaus adapter → abuse.ch feeds: requests feed
- ThreatFox adapter → abuse.ch feeds: requests feed
- Feed loading → Feed cache: reads and writes
- Feed loading → Local indicators: loads indicators
- Feed loading → Offline signatures: fallback loads
- Feed loading → Signature set: builds set
- CLI runner → PCAP reader: opens capture
- PCAP file → PCAP reader: provides bytes
- PCAP reader → Packet parser: parses frames
- CLI runner → Flow assembly: adds packets
- Packet parser → Flow assembly: provides packets
- Flow assembly → Protocol fields: extracts fields
- CLI runner → Detection engine: classifies flows
- Flow assembly → Detection engine: provides flows
- Signature set → Detection engine: matches indicators
- CLI runner → Report output: builds report
- Detection engine → Report output: provides verdicts
- Report output → JSON report: writes JSON
- Operator → Generator CLI: runs optionally
- Generator CLI → Feed loading: loads indicators
- Generator CLI → Capture synthesis: builds capture
- Signature set → Capture synthesis: selects targets
- Capture synthesis → PCAP file: writes PCAP