Leonid BugaevandGitHub
a5f5615156
Added support for capturing virtualized traffic. ## VXLAN https://en.wikipedia.org/wiki/Virtual_Extensible_LAN VXLAN implemented as separate engine, which opens UDP socket and awaits traffic. This approach is made to work with AWS Traffic Mirroring. In order to enable VXLAN set `--input-raw-engine vxlan` Example: ``` gor --input-raw :80 --input-raw-engine vxlan --output-stdout` ``` By default, it looks for vxlan traffic on the standard 4789 port, but you can override it with `--input-raw-vxlan-port`. Additionally, you can allow only specific VNIs using `--input-raw-vxlan-vni`, or disallow by using the same option, but by adding "minus" sign to the value: `--input-raw-vxlan-vni -2`. Example with all options: ``` gor --input-raw :80 --input-raw-engine vxlan --input-raw-vxlan-vni 1 --input-raw-vxlan-vni 2 --input-raw-vxlan-port 2222 --output-stdout ``` # VLAN https://en.wikipedia.org/wiki/IEEE_802.1Q VLAN protocol enabled using `--input-raw-vlan` argument, and you can filter for specific VLAN VIDs using `--input-raw-vlan-vid`. VLAN filtering happens on BPF level. Example: ``` gor --input-raw :80 --input-raw-vlan --input-raw-vlan-vid 1 --output-stdout` ``` ## Notes Did a refactoring of RAW Input options, so it will be easy to extend in future.
2.5 KiB
Think about Gor more like a network analyzer or tcpdump on steroids, it is not a proxy and does not affect your app anyhow. You specify application port, and it will capture and replay incoming data.
Simplest setup will be:
# Run on servers where you want to catch traffic. You can run it on every `web` machine.
sudo gor --input-raw :80 --output-http http://staging.com
It will record and replay traffic from the same machine. However, it is possible to use Aggregator-forwarder setup, when Gor on your web machines forward traffic to Gor aggregator instance running on the separate server.
You may notice that it require
sudo: to analyze network Gor need permissions which available only to root users. However, it is possible to configure Gor [beign run for non-root users](Running as a non-root user).
Forwarding to multiple addresses
You can forward traffic to multiple endpoints.
gor --input-tcp :28020 --output-http "http://staging.com" --output-http "http://dev.com"
Splitting traffic
By default, it will send same traffic to all outputs, but you have options to equally split it (round-robin) using --split-output option.
gor --input-raw :80 --output-http "http://staging.com" --output-http "http://dev.com" --split-output true
Tracking responses
By default input-raw does not intercept responses, only requests. You can turn response tracking using --input-raw-track-response option. When enable you will be able to access response information in middleware and output-file.
Traffic interception engine
By default, Gor will use libpcap for intercepting traffic, it should work in most cases. If you have any troubles with it, you may try alternative engine: raw_socket.
sudo gor --input-raw :80 --input-raw-engine "raw_socket" --output-http "http://staging.com"
You can read more about Replaying HTTP traffic.
You can use VXLAN or traffic mirroring from AWS to capture the traffic. The 4789 UDP port will be opened and that works as you are launched GoReplay on the source machine.
gor --input-raw :80 --input-raw-engine vxlan -output-stdout
Tracking original IP addresses
You can use --input-raw-realip-header option to specify header name: If not blank, injects header with given name and real IP value to the request payload. Usually, this header should be named: X-Real-IP, but you can specify any name.
gor --input-raw :80 --input-raw-realip-header "X-Real-IP" ...
Also you may want to know about Rate limiting, Request rewriting and Request filtering