cb-proxy - CGC Network Appliance

SYNOPSIS

cb-proxy [options] --host HOST --port PORT

DESCRIPTION

cb-proxy is an asynchronous TCP proxy server that allows for traffic inspection, modification, and logging in the DECREE environment. Inspection is performed in a 'Snort Like' domain specific language.

ARGUMENTS

--host HOST: Specify the HOST to forward traffic.
--port PORT: Specify the PORT to listen for incoming sessions and to connect to HOST.

OPTIONS

-h: Display a usage message and exit
--rules RULES: Specify a RULES file to for traffic inspection
--negotiate: Ignore the DECREE negotiation content that is used during CFE for PRNG seed communication
--listen_host HOST: Only listen for traffic on the specified HOST address
--listen_port PORT: Optionally listen for a different port than the destination port
--outbound_host HOST: Specify the HOST address to use for outbound communication
--max_connections MAX_CONNECTIONS: Specify the maximum number of connections to process before exiting
--pcap_host HOST: Specify the HOST to log the network traffic as it is sent to the destination
--pcap_port PORT: Specify the PORT to log the network traffic as it is sent to the destination
--csid CSID: Specify a unique identifier for the logged network traffic
--buffer_size SIZE: Specify a maximum size for the inspection buffer sliding window

Traffic Logging

If the pcap_host option is provided, cb-proxy will send all traffic via UDP to the specified host.

A sample application cb-packet-log is provided that listens to the traffic and records it in PCAP format.

A sample wireshark decoder, cgc.lua, can be used to inspect the pcaps generated by cb-packet-log.

EXAMPLE USES

cb-proxy --host cb --port 12345: This will create a proxy that forwards any communication between the client and server listening on port '12345' on the host 'cb'.
cb-proxy --host cb --port 12345 --rules ids.rules: This will create a proxy that inspects communication between the client and server listening on port '12345' on the host 'cb', using the rules specified in 'ids.rules'.

cb-proxy