chrivers / chrivers/tricorder

List some example metadata keys / formats. Keep a registry of new ones

Open
#3 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

So far, the ones I have used...

```
!file=path/to/foo.pcap.gz
# ... if my hexdump was generated from some other (possibly gzipped) raw capture / pcap
!start=2016-11-04T15:56:25Z
# timestamp that this packet capture started, in ISO8601 format, Zulu (UTC)
# suggest full yyyy-mm-ddThh:mm:ssZ
# decimal seconds hh:mm:ss.sss ? discuss :-)
!C01_connect=192.168.0.118:58656 @3637
# IPv4 address and port the client(01) has connected from (with @timestamp)
!S01_connect=192.168.0.112:2010 @3637
# IPv4 address and port the client(01) has connected TO - the server address.
# for my MitM proxy, this is actually the address THE PROXY connects to, but close enough, right?
# (OPTIONAL) stream numbers, I use 2 digits starting at 01 and incrementing, but as long as it's num eric I don't care much.
!C02_disconnect @24518
!S02_disconnect @24520
# Client and server disconnects, shown with timestamps
```
Other proposals include:
```
!proto_version=2.2.0
# Artemis BEADBEEF protocol version, as extracted from 0xe548e74a Version packet
!consoles=Main Helm Weap Eng Sci Comm Data Obs Capt GM
# Artemis consoles present on this connection, extracted from 0x19c6e2d4 ConsoleStatus packet
# ... and/or maybe 0x4c821d3c SetConsole packet
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the metadata examples and proposals in the issue body, then inspect the repository for any existing metadata documentation or registry. Done means documenting the listed keys and formats and establishing a maintained registry for new ones, including a resolved timestamp format.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.