hostsync

Purpose

hostsync is a daemon that periodically looks through captured traffic for new destination hosts and source clients, adds them to the host and client inventory, and enqueues TLS and nmap scan tasks (via Redis) for each newly discovered host. It also refreshes the last-seen time of active clients. Without hostsync running, hosts observed by capture never get scanned or shown as “hosts” in the dashboard.

Usage

hostsync -c <config.yaml> [-debug] [-once]

Flag	Default	Description
`-c`	—	Path to config file (required)
`-debug`	`false`	Enable debug logging
`-once`	`false`	Run a single sync pass and exit, instead of looping

Running with no flags at all prints usage and exits without doing anything.

Configuration

hostsync.yaml:

name: hostsync
clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: <clickhouse-user>
  password: "<clickhouse-password>"
redis:
  host: localhost
  port: 6379
  password: "<redis-password>"   # Redis AUTH is required
debug: false
sync_interval: 5m   # e.g. "5m", "1h" — defaults to 5m if unset

On startup, hostsync checks the database schema before starting the sync loop, and reports a Redis heartbeat (visible on the dashboard’s status page) if redis.host is set.

Examples

# Run as a daemon, syncing every sync_interval
hostsync -c hostsync.yaml

# Run a single sync and exit (useful right after a fresh capture)
hostsync -c hostsync.yaml -once

# Run with debug logging
hostsync -c hostsync.yaml -debug

capture tlsscand