Memcached sniffer (golang edition)

Listens to memcached protocol (documentation) traffic via pcap. Logs protocol violations and writes the offending tcp session to a file for replay.

Usage

• --interface or -i: The interface to sniff. Defaults to eth0 in Linux or en0 on a Mac.
• --filter or -f: Filter on the interface. Documentation here. Defaults to tcp and port 11211.
• --snaplength or -s: Maximum size to read for each packet. Defaults to 1600.
• --promiscuous or -p: Puts the interface into promiscuous mode.
• --timeout or -t: Timeout on a connection. Defaults to BlockForever. Please see the documentation on timeouts here for more information on setting this value safely.

Requirements

Build

This application was written in Go 1.6. Other versions of go have not been tested.

Changes to the memcached protocol parser will not be reflected in the application unless recompiled via Ragel. However, changes outside the protocol parser or simply building the application does not require anything other than the basic Go toolchain and dependencies.

Dependencies

• logrus
• gopacket with gopacket/layers and gopacket/pcap
• minio/cli

Runtime

This application must be run as root to engage the pcap listener. It will not return any data otherwise.

Acknowledgements

The Python-based memcache-sniffer project is what made the idea of this possible. Having the Ragel State Machine Compiler allowed this to be written in about a day.