Instacap-Rs is a high-performance, Rust-based network packet capture and anomaly detection tool with optional integration hooks for Kafka and Elasticsearch. It's designed for security analysts, sysadmins, and developers to monitor, analyze, and alert on suspicious network activity in real time.
1. Network Monitoring
- Captures live network packets from network interfaces
- Parses protocols (HTTP, DNS, SSL, TCP, UDP)
- Extracts metadata like IPs, ports, bytes transferred, connection states
2. Stream Processing Pipeline
- Real-time data ingestion through Kafka message queues
- High-performance data processing in Rust
- Asynchronous processing of thousands of network events per second
3. Machine Learning Analysis
- Feature extraction from network patterns
- Anomaly detection using statistical models
- Risk scoring based on traffic characteristics
- Pattern recognition for known attack signatures
Infrastructure:
- Docker containers for easy deployment
- Kafka for handling high-throughput data streams
- Elasticsearch as a time-series database
- Message queues and event-driven architecture
Security Analysis:
- Detects unusual traffic patterns (data exfiltration, port scanning)
- Identifies potential brute force attacks
- Flags suspicious protocol usage
- Monitors for malware communication patterns
Visualization & Alerting:
- Real-time dashboards showing network health
- Traffic volume analysis and trending
- Geographic mapping of connections
- Automated alerts for high-risk events
Programming:
- Rust for systems programming and performance
- Python for machine learning and data science
- Network protocol understanding
- Asynchronous programming patterns
DevOps & Infrastructure:
- Container orchestration with Docker
- Message queue systems (Kafka)
- Database administration (Elasticsearch)
- Monitoring and logging systems
Cybersecurity:
- Network traffic analysis techniques
- Threat detection methodologies
- Incident response workflows
- Security monitoring best practices
Real-World Applications Enterprise Security:
- SOC (Security Operations Center) monitoring
- Network intrusion detection
- Compliance reporting and auditing
- Incident investigation and forensics
Performance Monitoring:
- Network bandwidth analysis
- Application performance monitoring
- Infrastructure health tracking
- Capacity planning
- Real-time network traffic capture
- Anomaly and threat detection
- Traffic statistics & performance metrics
- Optional verbose output for debugging
- Stub integrations with Kafka and Elasticsearch
- CLI-based configuration
sudo apt-get update
sudo apt-get install libpcap-dev build-essentialsudo yum install libpcap-devel gccbrew install libpcap# Clone and navigate
cd instacap-rs
# Build in release mode
cargo build --releasesudo ./target/release/instacap-rs --help# Monitor default interface (eth0)
sudo ./target/release/instacap-rssudo ./target/release/instacap-rs -i wlan0sudo ./target/release/instacap-rs --promiscuoussudo ./target/release/instacap-rs -vsudo ./target/release/instacap-rs \
-i eth0 \
-k localhost:9092 \
-e http://localhost:9200 \
--promiscuous \
--timeout 2000 \
--buffer-size 131072 \
--anomaly-window 120 \
--traffic-threshold 2000 \
--verbose|----------------------------------------|------------------------------------------------------------|-----------------------------|
| `-i`, `--interface <INTERFACE>` | Network interface to monitor | `eth0` |
| `-k`, `--kafka-broker <KAFKA_BROKER>` | Kafka broker URL | `localhost:9092` |
| `-e`, `--elasticsearch-url <URL>` | Elasticsearch endpoint URL | `http://localhost:9200` |
| `--promiscuous` | Enable promiscuous mode to capture all traffic | `false` |
| `--timeout <TIMEOUT>` | Packet capture timeout in milliseconds | `1000` |
| `--buffer-size <BUFFER_SIZE>` | Buffer size for packet capture in bytes | `65536` |
| `--anomaly-window <SECONDS>` | Time window (in seconds) for anomaly detection | `60` |
| `--traffic-threshold <THRESHOLD>` | Packet count threshold for triggering anomaly detection | `1000` |
| `-v`, `--verbose` | Enable verbose output (includes debug-level information) | `false` |
[INFO] Starting Instacap-Rs Network Packet Analyzer
[INFO] Interface: eth0
...
[INFO] Packet capture started successfully
[INFO] === Traffic Statistics ===
[INFO] Total packets: 15847
[INFO] Total bytes: 12458392
[INFO] Top protocols: {"TCP": 12453, "UDP": 2847, "ICMP": 547}
[WARN] Port scan detected: 192.168.1.100: 25 ports in 60s
[ERROR] Brute force attack: 75 attempts to port 22
=== NETWORK SECURITY REPORT ===
- Total packets: 45623
- Suspicious IPs: 5
- Port scan attempts: 3
- Throughput: 78.9 Mbps
# Requires root permissions
sudo ./target/release/instacap-rs# List interfaces
ip link show # Linux
ifconfig -a # macOS/Linuxsudo apt-get install libpcap-dev pkg-config# Tune buffer size or timeout
sudo ./target/release/instacap-rs --buffer-size 32768 --timeout 2000- Kafka: Stubbed out; replace with real Kafka producer implementation.
- Elasticsearch: Stubbed out; replace with real Elasticsearch client logic.
- Production: Implement persistence and proper security logging for enterprise use.
- Requires root privileges to capture packets
- Captures potentially sensitive data
- Comply with data privacy & retention policies
- Customize threat detection to your needs
- Monitor CPU/memory impact in production
- Pull requests are welcome! For major changes, please open an issue first to discuss improvements or features.
MIT License. See LICENSE for details.
---
### ✅ Summary
This version follows the **standard GitHub README structure**:
1. Project name & description
2. Features
3. Installation
4. Usage
5. Command-line options
6. Expected output
7. Troubleshooting
8. Integration
9. Security
10. Contributing
11. License
Let me know if you'd like this saved as a file (`README.md`) or want badges (build status, licensInstacap-RS/
├── docker-compose.yml -Runs all components (Rust services, Python ML server, etc.) in isolated containers.
├── packet-capture/ - Captures live network traffic using low-level packet sniffing (like libpcap).
│ ├── Dockerfile
│ ├── src/
│ │ ├── main.rs
│ │ ├── packet_capture.rs - Core logic to sniff packets from interfaces
│ │ ├── protocol_parser.rs - Decodes Ethernet, IP, TCP/UDP, HTTP, etc.
│ │ ├── deep_inspection.rs - Payload analysis (e.g., detecting signatures or anomalies).
│ │ └── performance_metrics.rs - Measures network KPIs — latency, jitter, throughput.
│ └── Cargo.toml
├── analysis-engine/ - Analyzes packets for security and performance issues.
│ ├── src/
│ │ ├── main.rs
│ │ ├── anomaly_detector.rs - Checks for unusual patterns (spikes, rare protocols).
│ │ ├── threat_detector.rs - Signature/rule-based detection (malware, port scans).
│ │ ├── traffic_analyzer.rs - Summarizes traffic by IP, protocol, etc.
│ │ └── alert_manager.rs - Triggers alerts/logs when rules or thresholds are violated.
│ └── Cargo.toml
├── ml-models/ - Machine learning models for intelligent anomaly/threat detection.
│ ├── anomaly_detection.py - Detects statistical anomalies.
│ ├── threat_classification.py - Classifies threats (DDoS, scan, exfiltration).
│ ├── performance_predictor.py - Predicts network degradation.
│ └── model_server.py - Exposes ML models via an API (e.g., using FastAPI or Flask).
├── wireshark-integration/ - Custom filters and dissectors in Wireshark for deeper visualization.
│ ├── capture_filters.lua - Predefined capture rules.
│ └── custom_dissectors.lua - Protocol dissection to visualize custom/unknown protocols.
└── configs/
├── capture.conf - Interfaces and filters for capture.
├── detection_rules.yaml - Rules for threat/anomaly detection.
└── thresholds.json - Performance thresholds for alerts.