SLEUTH

• Get Started
• Libs related
• Commands
• Filter Languages
• Run NonAdmin
• Run Admin
• Abbreviations

Libs related

scapy, colorama, pydivert

Run as user (Proxy doesn't work but other features work well)

Run as administrator (Proxy works)

Get Started

• Step 1. Install packages from requirements.txt
• Step 2. Install npcap/winpcap on your windows device to support scapy
• Step 3. Run sleuth.py

Built-in Commands

----------------------------------------------------------------------

mntr [on/off]                                                         : start monitoring or stop monitoring.

ms [-p #port/-P #protocol]                                            : measure networking speed over a port or a protocol.

prx-win on / off / conf                                               : run, terminate or configurate (auto reboot) net proxy (on windows)

ls ip [-dsc/-asc #number] / ls int / ls pk [-sm/-dt] / ls wplog       : list ipv4 addresses, interfaces, captured packets and proxy log.

cap [-i #interface][-a #method][-c #counts][-f #filter][-t #seconds]  : capture packets over conditions.

save [#filepath]                                                      : save packets into file. if no filepath specified, save to ./sleuth.pcap by default.

load [#filepath]                                                      : load packets from a file into memory. if no filepath specified, load from ./sleuth.pcap by default.

discard                                                               : discard all packets captured which stored in memory

sys [#shell-commands]                                                 : execute shell command from os.

echo [#strings]                                                       : print back your input to screen.

exec [#scripts]                                                       : execute python script.

bye                                                                   : exit sleuth.

----------------------------------------------------------------------

Capture Filter Script

Berkeley Packet Filter

Proxy Configuration Filter Script

Windows Packet Divert

Abbreviations References

mntr - monitor
prx-win - proxy for windows
ms - measure {
 p(lower case) - port
 P(upper case) - protocol
}
ls - list {
 int - interface
 pk - packet
 wplog - log by proxy for windows
 dsc - descend
 asc - ascend
 sm - summaried
 dt - detailed
}
cap - capture {
 i - interface
 a - analysis
 c - count
 f - filter
 t - timeout
}
s - save
l - load
d - discard
sys - system
exec - execute