cuckoobox/cuckoo — pull request #111 by pdelsante (2013-05-22 19:22:33+00:00)
Title: Modularize network sniffer

In older Cuckoo releases the Sniffer object is static and only supports tcpdump-like tools.

This change transforms the old Sniffer into a module that gets started when the analysis starts, and stopped when the analysis finishes. The behaviour is exactly the same as before, but the difference is that now you can start as many network sniffers as you want, and even supporting new tools is as easy as writing a new module for them.

I already have a Snort IDS module ready to upload as soon as you accept this change, and I'm planning to write one for HoneyProxy too.

I know that most of these results could also be achieved by processing the pcap file captured by tcpdump with a dedicated processing module, but it's just a matter of how you want to spend your computational power. :)