mirror of
https://github.com/Av0idD4rk/packmate.git
synced 2026-10-23 15:31:00 +00:00
116 lines
4.1 KiB
Markdown
116 lines
4.1 KiB
Markdown
## Setup
|
||
|
||
Packmate reads its settings from `.env` in the same directory as `docker-compose.yml`.
|
||
Create it from the complete template and adjust the values for the server:
|
||
|
||
```bash
|
||
cp .env.example .env
|
||
${EDITOR:-nano} .env
|
||
```
|
||
|
||
### Primary settings
|
||
```dotenv
|
||
# Local IP of a server on which the traffic in directed. Used to tell incoming packets from outgoing.
|
||
PACKMATE_LOCAL_IP=10.20.1.1
|
||
# Username for the web interface
|
||
PACKMATE_WEB_LOGIN=SomeUser
|
||
# Password for the web interface
|
||
PACKMATE_WEB_PASSWORD=SomeSecurePassword
|
||
```
|
||
|
||
### Modes of operation
|
||
Packmate supports 3 modes of operation: `LIVE`, `FILE` и `VIEW`.
|
||
1. `LIVE` - the usual mode during a CTF. Packmate processes live traffic and instantly displays the results.
|
||
2. `FILE` - processes traffic from pcap files. Useful to analyze traffic from past CTFs where Packmate wasn't launched, or CTFs where it's impossible to use it on the vulnbox.
|
||
3. `VIEW` - Packmate does not process any traffic, but simply shows already processed streams. Useful for post-game analyses.
|
||
|
||
<details>
|
||
<summary>LIVE setup</summary>
|
||
|
||
Set the interface through which the game traffic passes.
|
||
IP address from `PACKMATE_LOCAL_IP` should be bound to the same interface.
|
||
|
||
```dotenv
|
||
# Mode: capturing
|
||
PACKMATE_MODE=LIVE
|
||
# Interface to capture on
|
||
PACKMATE_INTERFACE=game
|
||
```
|
||
|
||
High traffic installations can process captured packets in parallel. Both directions of one TCP/UDP
|
||
flow always use the same worker, which preserves packet ordering inside the flow. Start with `1` worker
|
||
as the compatibility setting and increase it only after running the network stress test on the target host:
|
||
|
||
```dotenv
|
||
PACKMATE_CAPTURE_WORKERS=1
|
||
PACKMATE_CAPTURE_QUEUE_CAPACITY=250000
|
||
PACKMATE_CAPTURE_BUFFER_SIZE_BYTES=67108864
|
||
PACKMATE_CAPTURE_SHUTDOWN_TIMEOUT_SECONDS=30
|
||
# Must be longer than the application shutdown timeout.
|
||
PACKMATE_CONTAINER_STOP_GRACE_PERIOD=45s
|
||
```
|
||
|
||
The queue is bounded. If it fills, Packmate remains alive and increments `applicationDroppedPackets`
|
||
in `GET /api/pcap/metrics`. In production this counter, `droppedPackets`, and
|
||
`interfaceDroppedPackets` should remain zero. `maximumQueuedPackets` is the maximum number of packet
|
||
tasks that waited for processing since capture started.
|
||
|
||
</details>
|
||
|
||
<details>
|
||
<summary>FILE setup</summary>
|
||
|
||
Set the name of the pcap file in the `pcaps` directory.
|
||
After the startup, in the web interface, you will see the button that activates the file processing.
|
||
It's important that by this moment all services and patterns are already created (see Usage).
|
||
|
||
```dotenv
|
||
# Mode: pcap file anysis
|
||
PACKMATE_MODE=FILE
|
||
# Path to pcap file in the pcaps directory
|
||
PACKMATE_PCAP_FILE=dump.pcap
|
||
```
|
||
|
||
</details>
|
||
|
||
<details>
|
||
<summary>VIEW setup</summary>
|
||
|
||
In that mode, Packmate simply shows already existing data.
|
||
|
||
```dotenv
|
||
# Mode: viewing the data
|
||
PACKMATE_MODE=VIEW
|
||
```
|
||
|
||
</details>
|
||
|
||
### Database cleanup
|
||
On large CTFsб after some time a lot of traffic will pile up. This can slow Packmate down and take a lot of drive space.
|
||
|
||
To optimize the workflow, it is recommended to enable periodical database cleanup of old streams. It will only work in the `LIVE` mode.
|
||
```dotenv
|
||
PACKMATE_OLD_STREAMS_CLEANUP_ENABLED=true
|
||
# Delay between cleanup runs (in seconds).
|
||
PACKMATE_OLD_STREAMS_CLEANUP_INTERVAL_SECONDS=10
|
||
# Maximum active cleanup time in one run (in seconds).
|
||
PACKMATE_OLD_STREAMS_CLEANUP_MAX_RUN_SECONDS=5
|
||
# How old the stream must be to be removed (in minutes before current time)
|
||
PACKMATE_OLD_STREAMS_CLEANUP_THRESHOLD=15
|
||
```
|
||
Replace the old `PACKMATE_OLD_STREAMS_CLEANUP_INTERVAL` variable with
|
||
`PACKMATE_OLD_STREAMS_CLEANUP_INTERVAL_SECONDS`; the new value is measured in seconds.
|
||
|
||
### Additional settings
|
||
|
||
```dotenv
|
||
# Database password. Considering it only listens on localhost, it's not mandatory to change it, but you can do it for additional security.
|
||
PACKMATE_DB_PASSWORD=K604YnL3G1hp2RDkCZNjGpxbyNpNHTRb
|
||
# Packmate version. Change it if you want to use a different version from the docker registry.
|
||
BUILD_TAG=latest
|
||
```
|
||
|
||
To use the TLS decryption, you have to put the matching private key in the `rsa_keys` directory.
|
||
|
||
Database files are being saved in `./data`, so to reset the database, you need to delete this directory.
|