PRADS(1)

NAME
PRADS - Passive Real-time Asset Detection System

SYNOPSIS
        prads -i eth1 -v

DESCRIPTION

PRADS is a Passive Real-time Asset Detection System.

PRADS employs digital fingerprints to recognize services on the wire, and can be used to map your network and monitor for changes in real time.

Real-time passive traffic analysis will also let you detect assets that are just connected to the network for a short period of time, since PRADS can glean useful information from every packet.

PRADS aims to be the one-stop-shop for passive asset detection, and currently does MAC lookups, TCP and UDP OS fingerprinting as well as client and service application matching and a connection state table. Various output plugins include logfile and FIFO and make PRADS a useful replacement for p0f, pads and sancp.

PRADS was built from the ground up for a small footprint and modern networks with IPv6 and gigabits of throughput.

OPTIONS

            -i <iface>
                Network device <iface> (default: eth0).

            -r <file>
                Read pcap <file>.

            -c <file>
                Read config from <file>

            -b <filter>
                Apply Berkeley packet filter <filter>.

            -u <user>
                Run as user <user>.

            -g <group>
                Run as group <group>.

            -a <nets>
                Specify home nets (eg: '192.168.0.0/25,10.0.0.0/255.0.0.0').

            -D  Enables daemon mode.

            -p <pidfile>
                Name of pidfile - inside chroot

            -l <file>
                Log assets to <file> (default: '/var/log/prads-asset.log')

            -f <FIFO>
                Log assets to <FIFO> -C <dir> Chroot into <dir> before dropping privs.

            -XFRMSAK
                Flag picker: X - clear flags, F:FIN, R:RST, M:MAC, S:SYN, A:ACK, K:SYNACK

            -UTtI
                Service checks: U:UDP, T:TCP-server, I:ICMP, t:TCP-cLient

            -s <snaplen>
                Dump <snaplen> bytes of each payload.

            -v  Verbose output - repeat for more verbosity.

            -q  Quiet - try harder not to produce output.

            -O  Connection tracking [O]utput - per-packet!

            -x  Conne[x]ion tracking output - New, expired and ended.

            -h  This help message.

PROBLEMS

    1.  Doesn't detect everything out there :-P

SEE ALSO

    •   PRADS <http://prads.projects.linpro.no/>

    •   p0f <http://lcamtuf.coredump.cx/p0f.shtml>

    •   PADS <http://passive.sourceforge.net/>

BUGS

Report bugs here:

    •   http://github.com/gamelinux/prads/issues

For general questions:

    •   http://projects.linpro.no/mailman/listinfo/prads-devel

    •   http://projects.linpro.no/mailman/listinfo/prads-users

AUTHOR
Edward Bjarte Fjellskål <edwardfjellskaal@gmail.com>, Kacper Wysocki <comotion@users.sf.net>

COPYRIGHT
GPL