Stenographer is a full-packet-capture utility for buffering packets to disk for intrusion detection and incident response purposes. It provides a high-performance implementation of NIC-to-disk packet writing, handles deleting those files as disk fills up, and provides methods for reading back specific sets of packets quickly and easily.
Stenographer uses AF-PACKET for packet acquisition.
Stenographer writes full packet capture to
You can access full packet capture via PCAP:
Stenographer reads its configuration from
/opt/so/conf/steno/. However, please keep in mind that if you make any changes to this directory they may be overwritten since the configuration is managed with Salt.
Diagnostic logging for Stenographer can be found at