PRADS(1)							    networking								  PRADS(1)

NAME

       PRADS - Passive Real-time Asset Detection System

SYNOPSIS

	  prads -i eth1 -v

DESCRIPTION

       PRADS is a Passive Real-time Asset Detection System.

       PRADS  employs  digital fingerprints to recognize services on the wire, and can be used to map your network and monitor for changes in real
       time.

       Real-time passive traffic analysis will also let you detect assets that are just connected to the network for a short period of time, since
       PRADS can glean useful information from every packet.

       PRADS  aims  to	be the one-stop-shop for passive asset detection, and currently does MAC lookups, TCP and UDP OS fingerprinting as well as
       client and service application matching and a connection state table. Various output plugins include logfile and FIFO and make PRADS a use-
       ful replacement for p0f, pads and sancp.

       PRADS was built from the ground up for a small footprint and modern networks with IPv6 and gigabits of throughput.

OPTIONS

	  -i <iface>
		 Network device <iface> (default: eth0).

	  -r <file>
		 Read pcap <file>.

	  -c <file>
		 Read config from <file>

	  -b <filter>
		 Apply Berkeley packet filter <filter>.

	  -u <user>
		 Run as user <user>.

	  -g <group>
		 Run as group <group>.

	  -a <nets>
		 Specify home nets (eg: '192.168.0.0/25,10.0.0.0/255.0.0.0').

	  -D	 Enables daemon mode.

	  -p <pidfile>
		 Name of pidfile - inside chroot

	  -l <file>
		 Log assets to <file> (default: '/var/log/prads-asset.log')

	  -f <FIFO>
		 Log assets to <FIFO> -C <dir>	      Chroot into <dir> before dropping privs.

	  -XFRMSAK
		 Flag picker: X - clear flags, F:FIN, R:RST, M:MAC, S:SYN, A:ACK, K:SYNACK

	  -UTtI  Service checks: U:UDP, T:TCP-server, I:ICMP, t:TCP-cLient

	  -s <snaplen>
		 Dump <snaplen> bytes of each payload.

	  -v	 Verbose output - repeat for more verbosity.

	  -q	 Quiet - try harder not to produce output.

	  -O	 Connection tracking [O]utput - per-packet!

	  -x	 Conne[x]ion tracking output  - New, expired and ended.

	  -h	 This help message.

PROBLEMS

       1. Doesn't detect everything out there :-P

SEE ALSO

       o PRADS <http://prads.projects.linpro.no/>

       o p0f <http://lcamtuf.coredump.cx/p0f.shtml>

       o PADS <http://passive.sourceforge.net/>

BUGS

       Report bugs here:

       o http://github.com/gamelinux/prads/issues

       For general questions:

       o http://projects.linpro.no/mailman/listinfo/prads-devel

       o http://projects.linpro.no/mailman/listinfo/prads-users

AUTHOR

       Edward Bjarte Fjellskal <edwardfjellskaal@gmail.com>, Kacper Wysocki <comotion@users.sf.net>

COPYRIGHT

       GPL

0.2								    2010-06-17								  PRADS(1)