tcpcat: an open-source network recon engine in Go with eBPF/AF_XDP and WASM detection

Описание и применение

tcpcat объединяет в одном инструменте сканирование сети, обнаружение сервисов, сопоставление с CVE и проверку видимости IDS/IPS, используя eBPF/AF_XDP для высокой пропускной способности и WASM для безопасных плагинов.

Задача

Need a single tool to enumerate networks, fingerprint services, correlate with CVEs, and test IDS/IPS visibility without combining multiple programs.

Результат

tcpcat enables high-throughput network scanning (≈1M packets/s/core) with advanced detection and monitoring assessment in a single tool.

Рабочий процесс

• Clone the repository
• Build the binary with Go 1.26+
• Run tcpcat to enumerate ports (TCP, UDP, ICMP)
• Map service topology with version fingerprinting
• Perform asynchronous DNS/mDNS/NetBIOS discovery
• Query CVE databases (Vulners API, Google OSV, or offline)
• Apply assessment controls (timing jitter, fragmentation, decoy traffic, window tuning, source-port selection)
• Write and load WASM detection rules
• Analyze results

Доказательства

I wanted one tool that could enumerate a network, fingerprint what it finds, correlate it with known CVEs, and let me check whether my IDS/IPS actually sees what it should, without stitching together five different programs.

Источник

On Linux (kernel 5.8+), tcpcat can use eBPF / AF_XDP to do packet I/O at the driver level and bypass the socket layer. That's what makes high-throughput scanning possible (around 1M packets per second per core).

Источник