Package: netconan
NetconanNetconan (network configuration anonymizer) anonymizes text files that contain sensitive network information.With Netconan, a sensitive input file$catsensitive/cisco.cfg!Thisisintentionet'ssensitivecommentusernameadminpassword7122A001901enablesecret5$1$wtHI$0rN7R8PKwC30AsCGA77vy.!tacacs-serverhost1.2.3.4keypwd1234ipaddress10.10.20.30/24ipaddress2001:2002::9d3b:1!route-mapsea-to-lax...route-mapsea-to-atl...can be anonymized$netconan-isensitive-oanonymized\--sensitive-wordsintentionet,sea,lax,atl\--anonymize-passwords\--anonymize-ipsWARNINGNosaltwasprovided;usingrandomlygenerated"WNo5pX28MJOrqxfv"INFOAnonymizingcisco.cfgto produce an output file you can feel comfortable sharing.$catanonymized/cisco.cfg!Thisisdb1792'ssensitivecommentusernameadminpassword709424B1D1A0A1913053E012724322D3765enablesecret5$1$0000$EhfXcDfB7iiakW6mwMy1i.!tacacs-serverhost7.227.130.88keynetconanRemoved2ipaddress10.72.218.183/24ipaddresscd7e:83e:1eaf:2ada:7535:591e:6d47:a4b8!route-mape69ceb-to-880ac2...route-mape69ceb-to-5d37ad...Installing NetconanInstall Netconan usingpip:$pipinstallnetconanFeaturesNetconan can anonymizemany types of sensitive information:Sensitive strings like passwords or SNMP community strings (--anonymize-passwords,-p), for many common network vendors.IPv4 and IPv6 addresses (--anonymize-ips,-a).User-specified sensitive words (--sensitive-words,-w).Note that any occurrence of a specified sensitive word will be replaced regardless of context, even if it is part of a larger string.User-specified AS numbers (--as-numbers,-n).Note that any number matching a specified AS number will be anonymized.Netconan attempts topreserve useful structure. For example,Netconan preserves prefixes when anonymizing IPv4 and IPv6 addresses: IP addresses with a common prefix before anonymization will share the same prefix length after anonymization. For more information, see J. Xu et al.,On the Design and Performance of Prefix-Preserving IP Traffic Trace Anonymization, ACM SIGCOMM Workshop on Internet Measurement, 2001 [link].IPv4 classes and private-use prefixes (seeIANA IPv4 assignments) are preserved by default, but can be overridden (with--preserve-prefixese.g.--preserve-prefixes12.0.0.0/8will preserve a leading octet12of IP addresses encountered but anonymize octets after the12).By default, the last8bits of each IP address are preserved. This prevents IP anonymization from breaking important network structure such as point-to-point IPv4 /30 links or NAT pools. This can be overridden to a new numberBusing--preserve-host-bitsB, and it can be disabled entirely using--preserve-host-bits0.Specific addresses can optionally be preserved, e.g.--preserve-addressesskips anonymizing the specified network or address. For example,--preserve-addresses12.0.0.0/8,13.12.11.10will skip anonymization for any address in the12.0.0.0/8network and skip anonymizing13.12.11.10.--preserve-private-addressesskips anonymizing all addresses that fall under private-use blocks.AS number blocks are preserved (i.e. an anonymized public AS number will still be in the public AS number range after anonymization).Standard password and hash formats (salted md5, Cisco Type 7, Juniper Type 9) are recognized and substituted with format-compliant replacements.Netconan isdeterministicwhen provided the same user-controllable salt (--salt,-s). Files processed using the same salt are compatible (e.g., IP addresses anonymized the same way) whether anonymized together or separately. Setting the salt in a configuration file is recommended, so that you can get compatible anonymization each time you use netconan.Forreversible operations(specifically, IP address anonymization), Netconan can produce a de-anonymized file (--undo,-u) when provided with the same salt used in anonymization (--salt,-s).Running netconanNetconan processes theinputfile or recursively processes files in theinputdirectory (skipping files starting with.) and saves processed files at the specifiedoutput.For more information about less commonly-used features, see the Netconan help (-h).  For more information on config file syntax, seehere.usage:netconan[-h][--version][-a][-cCONFIG][-dDUMP_IP_MAP]-iINPUT[-l{DEBUG,INFO,WARNING,ERROR,CRITICAL}][-nAS_NUMBERS]-oOUTPUT[-p][-rRESERVED_WORDS][-sSALT][-u][-wSENSITIVE_WORDS][--preserve-prefixesPRESERVE_PREFIXES][--preserve-addressesPRESERVE_ADDRESSES][--preserve-private-addresses][--preserve-host-bitsPRESERVE_HOST_BITS]Argsthatcanstartwith'--'canalsobesetinaconfigfile(specifiedvia-c).Ifanargisspecifiedinmorethanoneplace,thencommandlinevaluesoverrideconfigfilevalueswhichoverridedefaults.Configfilesyntaxallows:key=value,flag=true,stuff=[a,b,c](formoredetails,seeherehttps://goo.gl/R74nmi).optionalarguments:-h,--helpshowthishelpmessageandexit--versionPrintversionnumberandexit-a,--anonymize-ipsAnonymizeIPaddresses-cCONFIG,--configCONFIGNetconanconfigurationfilewithdefaultsfortheseCLIparameters-dDUMP_IP_MAP,--dump-ip-mapDUMP_IP_MAPDumpIPaddressanonymizationmaptospecifiedfile-iINPUT,--inputINPUTInputfileordirectorycontainingfilestoanonymize-l{DEBUG,INFO,WARNING,ERROR,CRITICAL},--log-level{DEBUG,INFO,WARNING,ERROR,CRITICAL}Determineswhatleveloflogstodisplay-nAS_NUMBERS,--as-numbersAS_NUMBERSListofcommaseparatedASnumberstoanonymize-oOUTPUT,--outputOUTPUTOutputfileordirectorywhereanonymizedfilesareplaced-p,--anonymize-passwordsAnonymizepasswordandsnmpcommunitylines-rRESERVED_WORDS,--reserved-wordsRESERVED_WORDSListofcommaseparatedwordsthatshouldnotbeanonymized-sSALT,--saltSALTSaltforIPandsensitivekeywordanonymization-u,--undoUndoreversibleanonymization(mustspecifysalt)-wSENSITIVE_WORDS,--sensitive-wordsSENSITIVE_WORDSListofcommaseparatedkeywordstoanonymize--preserve-prefixesPRESERVE_PREFIXESListofcommaseparatedIPprefixestopreserve.Specifiedprefixesarepreserved,butthehostbitswithinthoseprefixesarestillanonymized.Topreserveprefixesandhostbitsinspecifiedblocks,use--preserve-addressesinstead--preserve-addressesPRESERVE_ADDRESSESListofcommaseparatedIPaddressesornetworkstopreserve.Prefixesandhostbitswithinthosenetworksarepreserved.Topreservejustprefixesandanonymizehostbits,use--preserve-prefixes--preserve-private-addressesPreserveprivate-useIPaddresses.Prefixesandhostbitswithintheprivate-useIPnetworksarepreserved.Topreservespecificaddressesornetworks,use--preserve-addressesinstead.Topreservejustprefixesandanonymizehostbits,use--preserve-prefixes--preserve-host-bitsPRESERVE_HOST_BITSPreservethetrailingbitsofIPaddresses,akathehostbitsofanetwork.Setthisvaluelargeenoughtorepresentthelargestinterfacenetwork(e.g.,8fora/24or12fora/20)orNATpool.