From 04eae3a43e5e596c787067cc125a3cfedcbacab9 Mon Sep 17 00:00:00 2001 From: Cobra Date: Mon, 6 Apr 2026 11:36:24 -0400 Subject: [PATCH] Add requires_capture_bus attribute to BaseModule and passive modules - BaseModule now has requires_capture_bus = False default - All 17 passive modules set requires_capture_bus = True - bigbrother.py imports CaptureBus from core.capture_bus - Ready for Engine to instantiate and inject CaptureBus --- bigbrother.py | 1 + modules/base.py | 1 + modules/passive/auth_flow_tracker.py | 1 + modules/passive/cloud_token_harvester.py | 1 + modules/passive/credential_sniffer.py | 1 + modules/passive/db_interceptor.py | 1 + modules/passive/dns_logger.py | 1 + modules/passive/host_discovery.py | 1 + modules/passive/kerberos_harvester.py | 1 + modules/passive/ldap_harvester.py | 1 + modules/passive/network_mapper.py | 1 + modules/passive/os_fingerprint.py | 1 + modules/passive/packet_capture.py | 1 + modules/passive/quic_analyzer.py | 1 + modules/passive/rdp_monitor.py | 1 + modules/passive/smb_monitor.py | 1 + modules/passive/tls_sni_extractor.py | 1 + modules/passive/traffic_analyzer.py | 1 + modules/passive/vlan_discovery.py | 1 + 19 files changed, 19 insertions(+) diff --git a/bigbrother.py b/bigbrother.py index d86bcfb..71cfbd6 100755 --- a/bigbrother.py +++ b/bigbrother.py @@ -37,6 +37,7 @@ from core.tool_manager import ToolManager from core.scheduler import Scheduler from core.resource_monitor import ResourceMonitor from core.kill_switch import KillSwitch +from core.capture_bus import CaptureBus from modules.base import BaseModule from utils.config_loader import load_config, ConfigLoader from utils.resource import ( diff --git a/modules/base.py b/modules/base.py index 792c402..8483539 100644 --- a/modules/base.py +++ b/modules/base.py @@ -15,6 +15,7 @@ class BaseModule(ABC): priority: int = 100 # OOM priority (lower = more important) dependencies: list = [] # Module names that must be running first requires_root: bool = False + requires_capture_bus: bool = False def __init__(self, bus, state, config, engine=None): self.bus = bus diff --git a/modules/passive/auth_flow_tracker.py b/modules/passive/auth_flow_tracker.py index 4fba74a..e9c7df8 100644 --- a/modules/passive/auth_flow_tracker.py +++ b/modules/passive/auth_flow_tracker.py @@ -117,6 +117,7 @@ class AuthFlowTracker(BaseModule): "or port 3389 or port 22 or port 1433" ) self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter=bpf, queue_depth=5000 ) diff --git a/modules/passive/cloud_token_harvester.py b/modules/passive/cloud_token_harvester.py index 6143e56..853da05 100644 --- a/modules/passive/cloud_token_harvester.py +++ b/modules/passive/cloud_token_harvester.py @@ -95,6 +95,7 @@ class CloudTokenHarvester(BaseModule): return self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="port 80", queue_depth=3000 ) diff --git a/modules/passive/credential_sniffer.py b/modules/passive/credential_sniffer.py index 49f6738..fa41036 100644 --- a/modules/passive/credential_sniffer.py +++ b/modules/passive/credential_sniffer.py @@ -97,6 +97,7 @@ class CredentialSniffer(BaseModule): bpf_filter = "port 80 or port 21 or port 23 or port 25 or port 110 or port 143 or port 389 or port 88 or port 445" self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter=bpf_filter, queue_depth=8000 ) diff --git a/modules/passive/db_interceptor.py b/modules/passive/db_interceptor.py index c409e0d..53ce5b4 100644 --- a/modules/passive/db_interceptor.py +++ b/modules/passive/db_interceptor.py @@ -110,6 +110,7 @@ class DBInterceptor(BaseModule): bpf = "port 1433 or port 3306 or port 5432 or port 6379 or port 27017" self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter=bpf, queue_depth=5000 ) diff --git a/modules/passive/dns_logger.py b/modules/passive/dns_logger.py index c72dc49..209189d 100644 --- a/modules/passive/dns_logger.py +++ b/modules/passive/dns_logger.py @@ -363,6 +363,7 @@ class DNSLogger(BaseModule): except Exception: parts.append("?") offset += length + requires_capture_bus = True name = ".".join(parts) if parts else "" return (name, saved_offset if jumped else offset) diff --git a/modules/passive/host_discovery.py b/modules/passive/host_discovery.py index 79ed0fd..20b7bc9 100644 --- a/modules/passive/host_discovery.py +++ b/modules/passive/host_discovery.py @@ -640,6 +640,7 @@ class HostDiscovery(BaseModule): break parts.append(data[offset:offset + length].decode("utf-8", errors="replace")) offset += length + requires_capture_bus = True name = ".".join(parts) if parts else "" return (name, saved_offset if jumped else offset) diff --git a/modules/passive/kerberos_harvester.py b/modules/passive/kerberos_harvester.py index 052870c..f4f2d91 100644 --- a/modules/passive/kerberos_harvester.py +++ b/modules/passive/kerberos_harvester.py @@ -89,6 +89,7 @@ class KerberosHarvester(BaseModule): self._init_db() self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="port 88", queue_depth=5000 ) diff --git a/modules/passive/ldap_harvester.py b/modules/passive/ldap_harvester.py index a1edf4a..cc5428f 100644 --- a/modules/passive/ldap_harvester.py +++ b/modules/passive/ldap_harvester.py @@ -108,6 +108,7 @@ class LDAPHarvester(BaseModule): return self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="port 389 or port 3268", queue_depth=5000 ) diff --git a/modules/passive/network_mapper.py b/modules/passive/network_mapper.py index ee405c2..62e6b3d 100644 --- a/modules/passive/network_mapper.py +++ b/modules/passive/network_mapper.py @@ -101,6 +101,7 @@ class NetworkMapper(BaseModule): # Subscribe to all traffic self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="", queue_depth=5000 ) diff --git a/modules/passive/os_fingerprint.py b/modules/passive/os_fingerprint.py index 316b05a..b1a3b7c 100644 --- a/modules/passive/os_fingerprint.py +++ b/modules/passive/os_fingerprint.py @@ -135,6 +135,7 @@ class OSFingerprint(BaseModule): # Actually, let's keep SYN filter and add a second subscriber self._capture_bus.unsubscribe(self.name) self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="tcp", # All TCP — we filter SYN and app-layer in code queue_depth=10000, diff --git a/modules/passive/packet_capture.py b/modules/passive/packet_capture.py index bf8a786..f657775 100644 --- a/modules/passive/packet_capture.py +++ b/modules/passive/packet_capture.py @@ -34,6 +34,7 @@ class PacketCapture(BaseModule): name = "packet_capture" module_type = "passive" priority = 50 + requires_capture_bus = True requires_root = True # Defaults diff --git a/modules/passive/quic_analyzer.py b/modules/passive/quic_analyzer.py index d530f96..c46b5a6 100644 --- a/modules/passive/quic_analyzer.py +++ b/modules/passive/quic_analyzer.py @@ -98,6 +98,7 @@ class QUICAnalyzer(BaseModule): return self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="udp port 443", queue_depth=3000 ) diff --git a/modules/passive/rdp_monitor.py b/modules/passive/rdp_monitor.py index 70e4b25..9c8ea5e 100644 --- a/modules/passive/rdp_monitor.py +++ b/modules/passive/rdp_monitor.py @@ -92,6 +92,7 @@ class RDPMonitor(BaseModule): return self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="port 3389", queue_depth=3000 ) diff --git a/modules/passive/smb_monitor.py b/modules/passive/smb_monitor.py index b5448b7..65da7c1 100644 --- a/modules/passive/smb_monitor.py +++ b/modules/passive/smb_monitor.py @@ -103,6 +103,7 @@ class SMBMonitor(BaseModule): return self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="port 445", queue_depth=5000 ) diff --git a/modules/passive/tls_sni_extractor.py b/modules/passive/tls_sni_extractor.py index 577936f..ee2cd15 100644 --- a/modules/passive/tls_sni_extractor.py +++ b/modules/passive/tls_sni_extractor.py @@ -89,6 +89,7 @@ class TLSSNIExtractor(BaseModule): self._init_db() self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="tcp port 443", queue_depth=8000 ) diff --git a/modules/passive/traffic_analyzer.py b/modules/passive/traffic_analyzer.py index e2d0da6..0bce9f4 100644 --- a/modules/passive/traffic_analyzer.py +++ b/modules/passive/traffic_analyzer.py @@ -105,6 +105,7 @@ class TrafficAnalyzer(BaseModule): # Subscribe to all traffic (no BPF filter) self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="", queue_depth=15000 ) diff --git a/modules/passive/vlan_discovery.py b/modules/passive/vlan_discovery.py index bcd522a..ce5bdef 100644 --- a/modules/passive/vlan_discovery.py +++ b/modules/passive/vlan_discovery.py @@ -113,6 +113,7 @@ class VLANDiscovery(BaseModule): # Broad filter: we need 802.1Q (any ethertype), CDP/DTP (SNAP), LLDP, STP, EAPOL # Compile a catch-all because these span multiple ethertypes and LLC frames self._sub_queue = self._capture_bus.subscribe( + requires_capture_bus = True name=self.name, bpf_filter="", queue_depth=3000 )