passer is a passive service locator that sniffs live traffic or parses pcap files to identify servers, clients, hostnames, and operating systems without sending a single packet, built for authorized network assessment work.
| Tool | activecm/passer — passive Python sniffer that identifies servers, clients, DNS names, OS fingerprints, and routers from live traffic or pcap files |
| Category | Passive network discovery / packet analysis |
| Primary Use | Inventorying live services, clients, MAC addresses, DNS entries, and routers on networks you are authorized to monitor, either from a live interface via -i or offline from pcap via -r |
| Safe Use | Educational and documentary analysis for authorized professionals: run only on networks you own or have explicit written permission to sniff, as the README itself reminds that you are responsible for obtaining permission |
| Telemetry Note | Emits no packets by design; because it is purely passive, defenders will not see scan traffic from passer itself — its output is CSV-style lines to stdout or a log file via -l, detectable only by observing who is capturing on a span port or running the process |
passer occupies a niche that is quietly valuable during the reconnaissance phase of an authorized engagement: it builds a complete picture of a network without transmitting anything. Where active scanners like nmap probe ports and inevitably announce themselves to IDS and logging infrastructure, passer sits on a monitoring interface — or reads a previously captured pcap — and reconstructs the topology from what the network is already saying. The README describes it as identifying live services and clients, Ethernet cards on the LAN, DNS entries, operating systems, and routers, all passively. That last word is the entire design philosophy, and it changes the risk calculus for scoped work on fragile or heavily monitored production segments.
The implementation is Python, built on scapy with ipaddress and pytz as supporting libraries, and licensed under GPL-3.0. One notable constraint surfaced by the repo metadata and README is the runtime requirement: passer targets Python >=2.4 and <3.0, which firmly dates the codebase to the Python 2 era. Practically, this means operators will need a Python 2 interpreter or the provided Docker image to run it on a modern system, and the Docker path is the saner choice. The repo topics confirm the stack: scapy, pcap, packet-sniffer, network-monitoring, with hacktoberfest and gplv3 tags indicating an open-source community posture from the activecm organization.
Installation is straightforward on Debian-family systems: sudo apt-get install arp-scan ettercap-text-only nmap wireshark for the system side, then sudo pip install -r requirements.txt. The README also recommends a small quality-of-life tweak — appending noenum = [ Resolve(), TCP_SERVICES, UDP_SERVICES ] to ~/.scapy_startup.py so that scapy does not perform DNS lookups of its own, which would violate the tool's passive guarantee. Optional integrations matter more than they first appear: nmap supplies Ethernet manufacturer strings and service descriptions, ettercap, wireshark, and arp-scan extend MAC vendor coverage, and p0f version 2 contributes the OS fingerprint database that populates the IP record type.
The Docker workflow is the recommended path for most users. A wrapper script, fetched with wget from the repo and made executable with chmod +x, transparently handles the container invocation, so ./passer -i eth0 works as if it were a native binary. Under the hood that expands to docker run --rm --name=passer -i --init --net=host --cap-add=net_raw activecm/passer -i eth0, and the --cap-add=net_raw flag is worth noting because it is the minimal privilege the container needs for live capture. The wrapper also supports docker stop passer for clean shutdown. For offline analysis, passer.py -r /path/to/packets.pcap requires no root privileges at all, which makes it convenient for reviewing captures collected elsewhere.
The input flexibility is where passer earns its keep operationally. Beyond interface capture with -i and file reading with -r (the two flags are mutually exclusive), it accepts raw pcap data on stdin via /proc/self/fd/0. The README demonstrates the full Unix idiom: tcpdump -i eth0 -qtnp -w - | ./passer.py -r /proc/self/fd/0 pipelines live capture straight into analysis, and zcat/bzcat variants handle compressed archives. This decoupling matters because it lets a field analyst capture packets with any tool on a sensor box and post-process them in a lab — a pattern that also fits cleanly into defensive network inventory workflows where the capture point and the analysis workstation are different machines.
The output format is deliberately austere and machine-friendly. Every record is a comma-separated line to stdout (and optionally to a log file via -l), with five columns: a two-letter type code, the IP address, the protocol evidence, a state field, and an optional description. The type vocabulary is compact and worth internalizing: IP records carry p0f OS guesses, MA records map IPs to MAC addresses and manufacturers from ARP replies, TC and TS describe TCP client and server ports, UC and US the UDP equivalents, DN captures DNS A/PTR answers, and RO flags routers identified by TTL-exceeded or unreachable ICMP messages. Because no field contains commas, the log imports directly into spreadsheets or SQL, which is exactly what you want when the deliverable is an asset inventory rather than a terminal scrollback.
The README's extraction recipes show how the maintainers expect the tool to be used in practice. Simple sort -u deduplication, grep on TCP_25,listening to isolate SMTP servers, or egrep '(^DN|^RO)' to pull DNS and router records turn the raw log into targeted queries. There are companion scripts, make-hosts and mergehosts, referenced on the author's site for converting accumulated DNS records into a hosts-style file — useful when building a name-resolution baseline for a scoped segment. The -u flag writes unhandled 'odd' packets to a separate pcap for signature development, and the maintainers explicitly invite contributions of those packets, which tells you the parser is signature-driven and still growing.
The BPF filter documentation doubles as a concise explanation of the tool's internal detection logic, which is rare and welcome. TCP server detection (TS) relies on SYN, SYN/ACK, and RST packets to infer open versus closed states, while service description strings require observing the ACK traffic that dominates live connections. OS fingerprinting (IP records) keys on TCP SYN packets feeding p0f; MAC attribution (MA) comes from ARP replies; router discovery (RO) from ICMP type 11 or type 3 messages. The README also candidly admits that as of version 1.16, the underlying library's built-in BPF filtering does not work reliably, and recommends the tcpdump-piping workaround instead — an honest limitation that reinforces the stdin-pipeline design.
Performance guidance is included for high-volume links: dropping ACK-only packets with a filter like not(tcp[13] & 0x17 = 0x10) reportedly eliminates over ninety percent of packet volume at the cost of some TCP service description strings, and excluding udp src port 53 sheds the relatively expensive DNS extraction work. These knobs matter when monitoring a busy trunk rather than a single segment. The troubleshooting section covers the predictable socket.error: (1, 'Operation not permitted') from attempting live capture without root, and points pcap-file analysis back to the privilege-free path as the remedy.
From a defensive standpoint, passer is as interesting to blue teams as to red: the same passive reconstruction that builds an attacker's target picture also gives defenders a zero-noise asset inventory, rogue-host detector, and shadow-IT mapper, since nothing it does perturbs the network or trips on scan-detection rules. Its purely passive nature is its telemetry signature as well — defenders will never see passer traffic because there is none; the observable artifact is the process itself, or a capture host attached to a span port. For authorized professionals who need defensible, low-impact discovery on networks they are permitted to monitor, passer remains a compact, transparent, and honest instrument, legacy Python runtime and all.
activecm/passer.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.