PADS(8)

📦
version 1.2 · 2 versions
, in fedora 43, fedora 44

👑 PADS(8) — bestie edition 💅

okay so. manual name is pads, and it lives in section 8 of the System Manager's Manual. she's giving system manager main character energy, and honestly? she ate. 🍓

✨ NAME ✨

pads — the Passive Asset Detection System. no cap, that's literally her whole name. 🎀

🌸 SYNOPSIS 🌸

pads <DhUvV> <-c file > <-d file > <-g group > <-i interface > <-n
network(s) > <-p file > <-r file > <-u file > <-w file > <expression>

that's the whole vibe check right there, bestie. all those angle brackets are just her way of saying "options, babes". 💖

🦋 DESCRIPTION 🦋

PADS is a libpcap based detection engine, and her entire thing is passively detecting network assets. she is designed to complement IDS technology by handing IDS alerts some much-needed context. she's not replacing your IDS, she's just being the supportive bestie in the group chat. 🫶

💜 Goals 💜

  • Passive — she records and identifies traffic she sees on a network without actively "scanning" a system. there will never be a packet sent from the pads application. not one. zero. nada. she's a listener, not a talker, and that's iconic. 🙈
  • Portable — she can be placed easily on a remote system, and she does not require any additional external libraries other than those associated with libpcap. low maintenance queen. 💅
  • Lightweight — logging goes to a simple CSV file. there's no need for a database or other data repository installed on the local machine. all correlation is done outside of the pads program. she just logs and leaves, periodt. ⭐

🎀 OPTIONS 🎀

  • -h — display help / usage information. the classic cry for help. 😭
  • -D — run PADS in the background (daemon mode). she's going ghost mode, bestie. 👑
  • -d file — dump banner data into a libpcap formatted file. this feature dumps the matched packet or the first 4 packets of an unmatched connection into a specified file. super useful for further identifying a service and also for aiding with signature development. 🔥
heads up bestie: this feature must be compiled into the application in order to use it. this can be done by adding '--enable-banner-grab' to the
  • -g group — this switch lets you specify a group that PADS will drop to after the libpcap interface has been initialized. drop it like it's hot, but only after init. 💅
  • -h — display help. (yes she's listed twice. she said it twice. let her cook.) 🙈
  • -i interface — specify an interface to be used. pick your fave, she doesn't judge. 🌈
  • -n network list — specify a set of networks to be monitored. only assets that exist within these networks will be recorded. the networks should be specified in the following format: 10.10.10.0/24,192.168.0.0/16 . 🌸
  • -p pid file — this switch lets you specify a PID file to be used in conjunction with daemon (-D) mode. the -D girlies need their paperwork. 🧚
  • -r file — read packets from a libpcap formatted file. rewind, replay, remix. ✨
  • -u user — this switch lets you specify a user that PADS will drop to after the libpcap interface has been initialized. same energy as -g, different paperwork. 💖
  • -w file — dump data into a file other than assets.csv. you can rename the output, but assets.csv remains her default fave. 🎀
  • expression — selects which packets will be processed. please see tcpdump(1) for details on the libpcap primitives. iykyk. 🌟

🌈 SEE ALSO 🌈

pads.conf(8), pads-report(8), pads-archiver(8), tcpdump(8), pcre(3)

the whole squad. go say hi. 🫶

Copyright (C) 2004 Matt Shelton <matt@mattshelton.com>

🙈 BUGS 🙈

please send bug reports to the author. he's nice, he wants to know. 🍓

💜 AUTHORS 💜

Matt Shelton <matt@mattshelton.com>

and that's the whole page, bestie!! 🎉 this one was dated 2005/06/17, and it's from the System Manager's Manual for pads — so like, retro but make it legendary. thanks for reading to the end, you're literally the main character. 💅✨🌸

📦 where this page comes from