4.1 KiB
Setup
Packmate reads its settings from .env in the same directory as docker-compose.yml.
Create it from the complete template and adjust the values for the server:
cp .env.example .env
${EDITOR:-nano} .env
Primary settings
# Local IP of a server on which the traffic in directed. Used to tell incoming packets from outgoing.
PACKMATE_LOCAL_IP=10.20.1.1
# Username for the web interface
PACKMATE_WEB_LOGIN=SomeUser
# Password for the web interface
PACKMATE_WEB_PASSWORD=SomeSecurePassword
Modes of operation
Packmate supports 3 modes of operation: LIVE, FILE и VIEW.
LIVE- the usual mode during a CTF. Packmate processes live traffic and instantly displays the results.FILE- processes traffic from pcap files. Useful to analyze traffic from past CTFs where Packmate wasn't launched, or CTFs where it's impossible to use it on the vulnbox.VIEW- Packmate does not process any traffic, but simply shows already processed streams. Useful for post-game analyses.
LIVE setup
Set the interface through which the game traffic passes.
IP address from PACKMATE_LOCAL_IP should be bound to the same interface.
# Mode: capturing
PACKMATE_MODE=LIVE
# Interface to capture on
PACKMATE_INTERFACE=game
High traffic installations can process captured packets in parallel. Both directions of one TCP/UDP
flow always use the same worker, which preserves packet ordering inside the flow. Start with 1 worker
as the compatibility setting and increase it only after running the network stress test on the target host:
PACKMATE_CAPTURE_WORKERS=1
PACKMATE_CAPTURE_QUEUE_CAPACITY=250000
PACKMATE_CAPTURE_BUFFER_SIZE_BYTES=67108864
PACKMATE_CAPTURE_SHUTDOWN_TIMEOUT_SECONDS=30
# Must be longer than the application shutdown timeout.
PACKMATE_CONTAINER_STOP_GRACE_PERIOD=45s
The queue is bounded. If it fills, Packmate remains alive and increments applicationDroppedPackets
in GET /api/pcap/metrics. In production this counter, droppedPackets, and
interfaceDroppedPackets should remain zero. maximumQueuedPackets is the maximum number of packet
tasks that waited for processing since capture started.
FILE setup
Set the name of the pcap file in the pcaps directory.
After the startup, in the web interface, you will see the button that activates the file processing.
It's important that by this moment all services and patterns are already created (see Usage).
# Mode: pcap file anysis
PACKMATE_MODE=FILE
# Path to pcap file in the pcaps directory
PACKMATE_PCAP_FILE=dump.pcap
VIEW setup
In that mode, Packmate simply shows already existing data.
# Mode: viewing the data
PACKMATE_MODE=VIEW
Database cleanup
On large CTFsб after some time a lot of traffic will pile up. This can slow Packmate down and take a lot of drive space.
To optimize the workflow, it is recommended to enable periodical database cleanup of old streams. It will only work in the LIVE mode.
PACKMATE_OLD_STREAMS_CLEANUP_ENABLED=true
# Delay between cleanup runs (in seconds).
PACKMATE_OLD_STREAMS_CLEANUP_INTERVAL_SECONDS=10
# Maximum active cleanup time in one run (in seconds).
PACKMATE_OLD_STREAMS_CLEANUP_MAX_RUN_SECONDS=5
# How old the stream must be to be removed (in minutes before current time)
PACKMATE_OLD_STREAMS_CLEANUP_THRESHOLD=15
Replace the old PACKMATE_OLD_STREAMS_CLEANUP_INTERVAL variable with
PACKMATE_OLD_STREAMS_CLEANUP_INTERVAL_SECONDS; the new value is measured in seconds.
Additional settings
# Database password. Considering it only listens on localhost, it's not mandatory to change it, but you can do it for additional security.
PACKMATE_DB_PASSWORD=K604YnL3G1hp2RDkCZNjGpxbyNpNHTRb
# Packmate version. Change it if you want to use a different version from the docker registry.
BUILD_TAG=latest
To use the TLS decryption, you have to put the matching private key in the rsa_keys directory.
Database files are being saved in ./data, so to reset the database, you need to delete this directory.