pcapworker

Purpose

pcapworker is a worker daemon that processes pcap:process tasks — extracting TLS handshakes from PCAP files that users have uploaded through the dashboard (POST /api/upload/pcap) and writing the results to ClickHouse, the same way live capture traffic would be stored. It notifies progress back over Redis pub/sub so the dashboard can show upload processing status.

Usage

pcapworker [-c <config.yaml>] [options]

Flag	Default	Description
`-c`	—	Path to config file
`-debug`	—	Enable debug logging
`-concurrency`	10	Number of concurrent workers
`-uploadpath`	—	Path where uploaded PCAP files are stored (use a dedicated directory, e.g. `/var/lib/insights/uploads`)
`-ports`	`443`	Comma-separated list of ports to filter for TLS
`-redis-host`	`localhost`	Redis host
`-redis-port`	`6379`	Redis port
`-ch-host`	`localhost`	ClickHouse host
`-ch-port`	`9000`	ClickHouse port
`-ch-db`	`insights`	ClickHouse database
`-ch-user`	`default`	ClickHouse username
`-ch-pass`	—	ClickHouse password

CLI flags override the config file where both are given; the config file is optional and a built-in default config is used if -c is omitted.

Configuration

name: pcapworker
uploadpath: /var/lib/insights/uploads
ports:
  - 443
concurrency: 10
debug: false

redis:
  host: localhost
  port: 6379
  password: "<redis-password>"   # Redis AUTH is required
  db: 0

clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: <clickhouse-user>
  password: "<clickhouse-password>"

Example

pcapworker -c pcapworker.yaml -debug

fingerprintd notifyd