tcpcat: an open-source network recon engine in Go with eBPF/AF_XDP and WASM detection

说明与用途

tcpcat 将网络扫描、服务指纹识别、CVE 关联和 IDS 可见性测试整合到一个 Go 工具中，利用 eBPF/AF_XDP 实现高吞吐量，并通过 WASM 进行安全插件沙箱化。

问题

Need a single tool to enumerate networks, fingerprint services, correlate with CVEs, and test IDS/IPS visibility without combining multiple programs.

结果

tcpcat enables high-throughput network scanning (≈1M packets/s/core) with advanced detection and monitoring assessment in a single tool.

工作流

• Clone the repository
• Build the binary with Go 1.26+
• Run tcpcat to enumerate ports (TCP, UDP, ICMP)
• Map service topology with version fingerprinting
• Perform asynchronous DNS/mDNS/NetBIOS discovery
• Query CVE databases (Vulners API, Google OSV, or offline)
• Apply assessment controls (timing jitter, fragmentation, decoy traffic, window tuning, source-port selection)
• Write and load WASM detection rules
• Analyze results

证据

I wanted one tool that could enumerate a network, fingerprint what it finds, correlate it with known CVEs, and let me check whether my IDS/IPS actually sees what it should, without stitching together five different programs.

来源

On Linux (kernel 5.8+), tcpcat can use eBPF / AF_XDP to do packet I/O at the driver level and bypass the socket layer. That's what makes high-throughput scanning possible (around 1M packets per second per core).

来源