PRADS(1)

📦
version 0.3.3 · 2 versions
, in debian bookworm, ubuntu jammy

✨ PRADS ✨

okay so bestie, welcome to PRADS(1) — that's the networking section of the manual, and honestly this page is a whole mood. 💖 stay for the vibes, the flags are all here, promise.

🦋 NAME 🦋

PRADS — Passive Real-time Asset Detection System. that's the name. that's the assignment. 💅

🍓 SYNOPSIS 🍓

prads -i eth1 -v

like… that's it. that's the whole invocation. so clean. so iconic. 🌸

🌈 DESCRIPTION 🌈

PRADS is a Passive Real-time Asset Detection System.

okay so PRADS employs digital fingerprints to recognize services on the wire, and you can use it to map your network and monitor for changes in real time. no cap, it's just sitting there listening and knowing things. 👑

Real-time passive traffic analysis will also let you detect assets that are just connected to the network for a short period of time, since PRADS can glean useful information from every packet. yes. every. single. packet. it's giving omnipresent. ✨

PRADS aims to be the one-stop-shop for passive asset detection, and currently does MAC lookups, TCP and UDP OS fingerprinting as well as client and service application matching and a connection state table. various output plugins include logfile and FIFO, and that makes PRADS a useful replacement for p0f, pads and sancp. not me replacing three whole tools at once. 🔥

PRADS was built from the ground up for a small footprint and modern networks with IPv6 and gigabits of throughput. tiny footprint, gigantic throughput, the duality of woman. 💜

💅 OPTIONS 💅

  • -i <iface> — network device <iface> (default: eth0).
  • -r <file> — read pcap <file>.
  • -c <file> — read config from <file>.
  • -b <filter> — apply Berkeley packet filter <filter>.
  • -u <user> — run as user <user> (Default: uid 1).
  • -g <group> — run as group <group> (Default: gid 1).
  • -d — do not drop privileges.
  • -a <nets> — specify home nets (eg: '192.168.0.0/25,10.0.0.0/255.0.0.0').
  • -D — daemonize.
  • -p <pidfile> — name of pidfile - inside chroot.
  • -l <file> — log assets to <file> (default: '%s')n", config.assetlog.) — yes, that default string is literally like that in the original, we do not fix it, we respect the lore. 💀
  • -f <FIFO> — log assets to <FIFO>.
  • -B — log connections to ringbuffer.
  • -C <dir> — chroot into <dir> before dropping privs.
  • -XFRMSAK — flag picker: X - clear flags, F:FIN, R:RST, M:MAC, S:SYN, A:ACK, K:SYNACK.
  • -UTtI — service checks: U:UDP, T:TCP-server, I:ICMP, t:TCP-cLient.
  • -P — DHCP fingerprinting.
  • -s <snaplen> — dump <snaplen> bytes of each payload.
  • -v — verbose output - repeat for more verbosity. stack it, girl. 📈
  • -q — quiet - try harder not to produce output.
  • -L <dir> — log cxtracker type output to <dir> (will be owned by <uid>).
  • -O — connection tracking [O]utput - per-packet!
  • -x — conne[x]ion tracking output - New, expired and ended.
  • -Z — passive DNS (Experimental).
  • -H — DHCP fingerprinting (Expermiental). ⚠️ (spelled exactly like that, we're keeping it)
  • -h — this help message.
heads up bestie: -Z and -H are both flagged experimental (and -H says "Expermiental"), so like… tread lightly, okay? 🫶

😭 PROBLEMS 😭

  1. Doesn't detect everything out there :-P
  2. This man page.

literally the most honest section in any manual ever. it's giving self-aware. 💀

🧚 SEE ALSO 🧚

🐛 BUGS 🐛

Report bugs here:

For general questions:

👑 AUTHOR 👑

Edward Bjarte Fjellskål <edwardfjellskaal@gmail.com>, Kacper Wysocki <comotion@users.sf.net>

GPL

and that's the page, bestie! this was PRADS version 0.2, dated 2010-06-17, living its best life in section PRADS(1). go map a network, stay hydrated, and remember: passive analysis hits different. 🎀💖✨

📦 where this page comes from