finger-sniffer

What it is

finger-sniffer accepts connections on a set of captured ports and records how they arrived: IP and TCP details (TTL, SYN options, JA4T, p0f guess, RTT, retransmissions, how the connection was closed), the TLS ClientHello and its fingerprints, the exact HTTP bytes, DNS queries and timing. Everything is returned, raw and analysed, through an API on ports that are not captured.

Use it to find out whether your traffic is intercepted on the way (proxies, middleboxes, TLS inspection) and which characteristics it has when it reaches the server.

Before you start

All traffic is public. Anything you send to the captured ports, including headers, cookies and request bodies, can be read by anyone through the API. Do not send secrets. Records are kept for about 10 minutes and then deleted.

Captured ports

Ports 9000 (HTTPS) and 9001 (HTTP) serve the API and are not captured.

How to probe

Pick a random probe ID of 8 to 32 lowercase letters and digits (for example k3x9q2mz7a) and use it both as the leftmost DNS label and in the path. The DNS lookup, the TCP and TLS handshakes and the HTTP request are then all tied to the same probe:

curl https://k3x9q2mz7a.dns-monitor.tmsoft.com.br/p/k3x9q2mz7a/

The response is a short text with the conn_id of your connection. The response can be controlled through /p/<id>/r?..., for example:

curl 'https://k3x9q2mz7a.dns-monitor.tmsoft.com.br/p/k3x9q2mz7a/r?status=204&conn=close'
curl 'https://k3x9q2mz7a.dns-monitor.tmsoft.com.br/p/k3x9q2mz7a/r?size=100000&frame=chunked'
curl 'https://k3x9q2mz7a.dns-monitor.tmsoft.com.br/p/k3x9q2mz7a/r?delay_head=500&h=X-Test:1'

On the raw TCP ports, send a PROBE <id> line first (optionally with mode=echo|banner|sink|source and n=N):

printf 'PROBE k3x9q2mz7a\r\nhello\r\n' | nc vps602.tmsoft.com.br 7

Where to see the result

Ask the API for everything recorded under your probe ID. wait holds the answer until all connections of the probe are closed (up to 60 s):

curl 'https://vps602.tmsoft.com.br:9000/api/v1/probes/k3x9q2mz7a?wait=10s'

The same API is available over plain HTTP on port 9001 (http://vps602.tmsoft.com.br:9001/api/v1/probes/<id>). Each connection also has its own record, raw bytes and a pcap: /api/v1/connections/<conn_id>, /api/v1/connections/<conn_id>/raw and /api/v1/connections/<conn_id>/pcap. When you are done, DELETE /api/v1/probes/<id> removes your records before the 10 minutes.

API reference

The full contract (OpenAPI 3.1) is at https://vps602.tmsoft.com.br:9000/api/v1/openapi.yaml (also over HTTP on port 9001). It covers connections, raw bytes, pcaps, DNS queries, stray packets, health and the live event stream.