pads.conf(8)

📦
version 1.2 · 2 versions
, in fedora 43, fedora 44

💖 pads.conf(8) 💖

System Manager's Manual — pads.conf, bestie. Yes, the whole manual. Sit down, get comfy, we're doing config file lore today. 🎀

✨ NAME ✨

pads.conf — it's the config file for pads, that's the whole vibe. 🌸

🦋 DESCRIPTION 🦋

Okay so this page is literally the field guide to the pads(8) configuration file format. That's it. That's the job. 📖

Two things get totally ignored, no thoughts head empty:

  • empty lines 💀
  • any line that starts with # (those are your comments, babes) 🎀

👑 PARAMETERS 👑

Every knob you can turn, coming right up. No skips, no skimming, we're listing all of them. ✨

  • daemon [0/1] — this one decides whether the app dips into the background like a true background character. 0 = Disable, 1 = Enable. 🫶
  • pid_file <file> — the filename of the pads PID file. Heads up: if you're planning on living that daemon mode life, you should set this. Set it, bestie. 🙈
  • sig_file <file> — an alternate location for the pads-signature-list file. ✨
  • mac_file <file> — an alternate location for the pads-ether-codes file. 💅
  • user <username> — the name of the user pads will run as when it gets started as root. 👑
  • group <groupname> — same energy: the name of the group pads will run as when started as root. 🧚
  • interface <interface> — the name of the interface PADS will listen to. Ears open, bestie. 👂
  • filter <filter> — a libpcap filter applied to the PADS session. For example, if you wanna filter only SSH traffic, you'd specify "filter 'port 22'". 🍓
  • network <network> — a comma separated list of networks to be monitored. Only assets found in these networks get recorded, so be picky. For example: "network 192.168.0.0/24,192.168.1.0/24,10.10.10.0/24". 🌈
  • output screen — this output plugin shows PADS data right on the screen. When you're using the configuration file, it defaults to off. 📺
  • output csv: <filename> [readonly] — this output plugin writes PADS data to a CSV file. Optionally you can hand it a CSV filename as an argument. And if you want the file used only to populate the internal known assets list but never ever updated, then use the readonly option — that's the move when you've got a baseline and you wanna use it for intrusion detection. Iconic, honestly. 🔥
  • output fifo: <filename> — this output plugin writes PADS data to a FIFO file. Optionally a FIFO filename can be specified as an argument. 💜
  • output prelude: <profilename> — this output plugin writes PADS data as IDMEF alerts via prelude. Optionally you can add a profile name if you want something different than the default of pads. ⭐

🌸 SEE ALSO 🌸

  • pads(8) — go read it, it's the moment. 🫶

Copyright (C) 2005 Matt Shelton <matt@mattshelton.com> — protect it, respect it. 🎀

🐛 BUGS 🐛

Found a bug? Please send bug reports to the author. Don't be shy, they want to hear it. 💌

✨ AUTHORS ✨

Matt Shelton <matt@mattshelton.com> — the main character who wrote all of this. 👑

k bye bestie, this page is from 2005/06/17 and it's part of the System Manager's Manual, and yes it's still serving. 💖✨🎀🦋🌸💅🫶

📦 where this page comes from