tcpcat: an open-source network recon engine in Go with eBPF/AF_XDP and WASM detection

Description and use

tcpcat consolidates network scanning, service fingerprinting, CVE correlation, and IDS visibility testing into a single Go tool, leveraging eBPF/AF_XDP for high throughput and WASM for sandboxed detection plugins.

Problem

Need a single tool to enumerate networks, fingerprint services, correlate with CVEs, and test IDS/IPS visibility without combining multiple programs.

Outcome

tcpcat enables high-throughput network scanning (≈1M packets/s/core) with advanced detection and monitoring assessment in a single tool.

Workflow

• Clone the repository
• Build the binary with Go 1.26+
• Run tcpcat to enumerate ports (TCP, UDP, ICMP)
• Map service topology with version fingerprinting
• Perform asynchronous DNS/mDNS/NetBIOS discovery
• Query CVE databases (Vulners API, Google OSV, or offline)
• Apply assessment controls (timing jitter, fragmentation, decoy traffic, window tuning, source-port selection)
• Write and load WASM detection rules
• Analyze results

Evidence

I wanted one tool that could enumerate a network, fingerprint what it finds, correlate it with known CVEs, and let me check whether my IDS/IPS actually sees what it should, without stitching together five different programs.

Source

On Linux (kernel 5.8+), tcpcat can use eBPF / AF_XDP to do packet I/O at the driver level and bypass the socket layer. That's what makes high-throughput scanning possible (around 1M packets per second per core).

Source