satta/gommunityid
GitHub: satta/gommunityid
该项目用 Go 语言实现了 Community ID 网络流哈希标准，为网络流量提供跨工具统一的标识符计算能力。
Stars: 22 | Forks: 4
# gommunityid
[](https://github.com/satta/gommunityid/actions)
[](https://coveralls.io/github/satta/gommunityid?branch=master)
[](https://goreportcard.com/report/github.com/satta/gommunityid)
[](http://godoc.org/github.com/satta/gommunityid)
gommunityid 是 [Community ID flow hashing 算法](https://github.com/corelight/community-id-spec)的 Golang 实现。其 API 设计明显受到了 [Python 参考实现](https://github.com/corelight/pycommunityid)的启发。
## 用法
```
package main
import (
"fmt"
"net"
"github.com/satta/gommunityid"
)
func main() {
// Get instance for version 1, seed 0
cid, _ := gommunityid.GetCommunityIDByVersion(1, 0)
// Obtain flow tuple. This can be done any way you like.
ft := gommunityid.MakeFlowTuple(net.IPv4(1, 2, 3, 4), net.IPv4(5, 6, 7, 8), 9, 10, 1)
// Calculate Base64-encoded value
communityid := cid.CalcBase64(ft)
fmt.Printf("%s\n", communityid)
// Calculate hex-encoded value
communityid = cid.CalcHex(ft)
fmt.Printf("%s\n", communityid)
// Calculate byte slice
communityidByte := cid.Calc(ft)
fmt.Printf("%v\n", communityidByte)
}
```
此外还提供了一个[便捷函数](https://godoc.org/github.com/satta/gommunityid#PcapFlowTupleSource)，用于解析 pcap 文件，并为所有支持的协议自动生成 FlowTuple。
## 命令行界面
这个包构建了一个简单的[命令行工具](cmd/gommunityid.go)来计算 pcap 的 ID：
```
$ ./gommunityid pcap
Usage: gommunityid pcap [options]
-seed uint
seed value (default 0)
-version uint
Community ID version (default 1)
$ gommunityid pcap testdata/tcp.pcap
1071580904.891921 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 128.232.110.120 66.35.250.204 6 34855 80
1071580905.035577 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 66.35.250.204 128.232.110.120 6 80 34855
1071580905.035724 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 128.232.110.120 66.35.250.204 6 34855 80
1071580905.037333 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 128.232.110.120 66.35.250.204 6 34855 80
1071580905.181581 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 66.35.250.204 128.232.110.120 6 80 34855
1071580905.184528 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 66.35.250.204 128.232.110.120 6 80 34855
1071580905.184844 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 128.232.110.120 66.35.250.204 6 34855 80
1071580905.184698 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 66.35.250.204 128.232.110.120 6 80 34855
1071580905.184920 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 128.232.110.120 66.35.250.204 6 34855 80
1071580905.184736 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 66.35.250.204 128.232.110.120 6 80 34855
1071580905.203025 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 128.232.110.120 66.35.250.204 6 34855 80
1071580905.346457 | 1:LQU9qZlK+B5F3KDmev6m5PMibrg= | 66.35.250.204 128.232.110.120 6 80 34855
```
以及显式 tuple 的 ID：
```
$ gommunityid tuple
Usage: gommunityid tuple [options]
-seed uint
seed value (default 0)
-version uint
Community ID version (default 1)
$ gommunityid tuple 6 66.35.250.204 128.232.110.120 80 34855
1:LQU9qZlK+B5F3KDmev6m5PMibrg=
```
## 作者/联系方式
Sascha Steinbiss
## 许可证
MIT
标签：Community ID, EVTX分析, Go, Ruby工具, 内核驱动, 哈希算法, 日志审计, 网络协议, 网络流量分析