Skip to content

v0.10.3

Choose a tag to compare

View all tags
@dreadl0ck dreadl0ck released this 05 Oct 22:09
· 86 commits to master since this release
v0.10.3
0354978

Native DPI performance

Uses go-dpi v1.5.0 with worker-owned nDPI contexts, incremental flow state, a ten-observation inspection budget, bounded tracking, and corrected native cleanup. Consecutive duplicate enrichment calls share progress. Small unidentified first packets are replayed once on promotion.

  • Set -dpi-workers (or NC_DPI_WORKERS) to select context count. One context minimizes native memory; automatic mode uses up to eight.
  • LPI + nDPI synthetic DPI microbenchmarks: 10 unidentified packets, 98.75 to 17.42 microseconds/flow; 100 unidentified packets, 1395.57 to 40.53 microseconds/flow. Whole-capture throughput depends on the workload.
  • At one context, the 32768-single-packet probe used 64.7 MiB peak RSS versus 109.1 MiB for the replay baseline. Eight contexts used 126.2 MiB.
  • Results and reproduction: internal/dpi/performance-results.json and zeus/scripts/benchmark-c-dpi.sh.

Upgrade notes

  • Distributed collection has a new TCP/TLS 1.3 wire format, incompatible with v0.10.2 and earlier. Upgrade net agent and net collect together; configure pinned agent identities. See docs/distributed-collection.md.
  • Database downloads now include attributed DB-IP Lite City geolocation; -geoProviders selects the provider set. Upgraded installations are prompted to fetch netcap.sqlite. See docs/resolvers.md.
  • Clean-runner CI passed native build/vet/race tests, optional JA4+ checks, frontend build, and license validation.

📦 Available Builds

Build OS Architecture DPI Support Description
netcap-v0.10.3-darwin-arm64 macOS ARM64 ✅ Yes Full DPI support with nDPI
netcap-v0.10.3-linux-amd64-libc Linux AMD64 ✅ Yes glibc-based with DPI
netcap-v0.10.3-linux-amd64-musl Linux AMD64 ✅ Yes musl-based with DPI (Alpine)
netcap-nodpi-v0.10.3-darwin-arm64 macOS ARM64 ❌ No Static build, no DPI
netcap-nodpi-v0.10.3-linux-amd64-libc Linux AMD64 ❌ No glibc-based, no DPI
netcap-nodpi-v0.10.3-linux-amd64-musl Linux AMD64 ❌ No musl-based, no DPI
netcap-nodpi-v0.10.3-windows-amd64 Windows AMD64 ❌ No Windows build

🔍 Choosing the Right Build

  • With DPI (netcap-*): Choose if you need Deep Packet Inspection features (protocol classification, application detection)
  • Without DPI (netcap-nodpi-*): Choose for basic packet capture and analysis, smaller binary size
  • libc vs musl: Use libc for standard Linux distros (Ubuntu, Debian, CentOS). Use musl for Alpine Linux or minimal containers

Installing on macOS via homebrew

Builds distributed via homebrew are built with DPI support.
You need to install the libprotoident and ndpi libraries via homebrew.

  $ brew install libprotoident ndpi
  $ brew tap dreadl0ck/formulas
  $ brew install netcap

Afterwards try running 'net' in your terminal.

📚 Documentation

⚠️ Notes

  • On macOS/Linux, you may need to grant necessary permissions: sudo chmod +x net
  • Live capture requires root/administrator privileges
  • Verify checksums with checksums.txt before use

Changelog

  • e03ac0d Bundle DB-IP Lite geolocation with selectable providers and retire unshippable database sources
  • 974bb21 Date the distributed-mode wire break after v0.10.1
  • e8c633a Date the distributed-mode wire break after v0.10.2, which kept the old format
  • 887071a Fix database prompt grammar and handle unbuilt frontend in embed tests
  • 0354978 Install archive-test dependencies in the CI builder
  • 285c3d2 Make capture corpus tests independent of local probe databases
  • 08b59cf Optimize native DPI with worker-owned incremental flow state
  • ac2eb83 Prepare v0.10.3 release with go-dpi v1.5.0
  • 1bdcff2 Prompt for netcap.sqlite on installs upgraded from the bleve layout
  • 24f220a Rebuild distributed mode on mutually authenticated TLS

Full Changelog: v0.10.1...v0.10.3

Assets 11
Loading