gibson - Network monitoring tool that maps process-to-netwo

项目说明

Gibson

Network monitoring tool that maps process-to-network connections, identifies cloud pro, and generates firewall rules. Lightweight agent for collection, server for aggregation, parser for analysis.

Screenshots

Cross-machine o — OS comparison, shared IP detection, beaconing candidates across all hosts:
!Cross-machine analysis

Per-host detail — critical alerts (EOL OS, nc.exe beaconing to unknown IP):
!Host detail - critical

Per-host detail — warning (beacon candidate flagged):
!Host detail - warning

Per-host detail — clean (no anomalies):
!Host detail - clean

Features

Collector (Agent)

Parser (Analyzer)

Quick Start

Build

Basic Collection (5 minutes)

Parse Collected Data

All-in-One Monitor Mode

Agent Build

The agent binary is a minimal, zero-flag deployment target. All configuration is burned into the binary at compile time — drop it on a target and run it with no arguments.

Build

The resulting binary at target/release/agent has no external dependencies and requires no flags:

En

| | Default | Description |
|---|---|---|
| AGENT_SERVER | | Upload endpoint URL |
| AGENT_KEY | *(none)* | X-API-Key header value |
| AGENT_INTERVAL | 5 | Socket poll interval in seconds |
| AGENT_BATCH | 200 | Records per upload batch |
| AGENT_DURATION | 0 | Run duration in seconds (0 = run forever) |
| AGENT_DNS | false | Resolve IPs to hostnames |
| AGENT_ESTABLISHED | true | ESTABLISHED connections only |
| AGENT_LOCAL_COPY | false | Keep a local .jsonl copy alongside uploads |
| AGENT_COMPRESS | false | Gzip compress before upload |
| AGENT_ENCRYPT_KEY | *(none)* | AES-256-GCM encrypt payload (password or 64-char hex key) |
| AGENT_UA | *(reqwest default)* | HTTP User-Agent header |

Example: Encrypted, Long-term Agent

Ad Usage

Secure Remote Collection

#### 1. Encrypted Collection with Upload

#### 2. Long-term Monitoring (24 hours)

IP Ownership Lookup

The parser supports two mutually exclusi for identifying who owns unmatched IPs:

| Method | Flag | Speed | Network | Best for |
|---|---|---|---|---|
| Local ASN DB | --asn-db | Instant | None | Repeated analysis, air-gapped en |
| Live ARIN RDAP | --arin-lookup | Slow (per-IP) | Yes | One-off lookups, no local DB a |

Download the ip2asn database (refresh weekly):

When --asn-db is provided, --arin-lookup is ignored. Use --arin-cache to persist ARIN results to disk so re-runs skip already-queried IPs.

Cloud Provider Analysis

Web Ser for Data Collection

Option 1: Simple Python Flask Server

Create collector_server.py:

Run with:

Option 2: Nginx with Basic Upload

Create /etc/nginx/sites-a/collector:

Option 3: AWS Lambda Function

Deployment Strategies

1. Corporate Network Monitoring

Deploy collectors on key systems:

2. Cloud Instance Monitoring

Use systemd service on Linux:

3. Container Deployment

Output Examples

Process Summary

Cloud Analysis

Firewall Rules (iptables)

Security Considerations

1. Encryption Keys: Use 32-byte hex keys or strong passwords
2. API Keys: Rotate regularly, use en
3. TLS: Always use HTTPS for uploads
4. Data Retention: Implement automatic cleanup policies
5. Access Control: Restrict collector ser
6. Monitoring: Alert on suspicious patterns

Performance Tips

Troubleshooting

High Memory Usage

Upload Failures

Missing Processes

License

MIT

Contributing

Pull requests welcome.

项目信息

开发语言：Rust

Star 数：213

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Network monitoring tool that maps process-to-network connections, identifies cloud providers, and detects beaconing activity. Zero-flag agent binary for deployment, aggregation server, offline ASN lookup.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。