vast

:crystal_ball: Visibility Across Space and Time

VAST

Build Status Chat License

Visibility Across Space and Time (VAST) is a platform for network forensics at scale.

Synopsis

Ingest a PCAP trace into a local VAST node:

vast -n import pcap < trace.pcap

Query a local VAST node and get the result back as PCAP trace:

vast -n export pcap -h "sport > 60000/tcp && src !in 10.0.0.0/8" \
  | ipsumdump --collate -w - \
  | tcpdump -r - -nl

Start a VAST node in the foreground, listening at 10.0.0.1:

vast -e 10.0.0.1 start -f

Send Bro logs to a remote node:

zcat *.log.gz | vast import bro

Resources

Contact

Installation

Source Build

Building VAST involves the following steps:

./configure
make
make test
make install

Required dependencies:

  • A C++14 compiler:
    • Clang 3.5
    • GCC 6
  • CMake
  • CAF (develop branch)

Optional:

FreeBSD

FreeBSD ships with a C++14 compiler. One can install as the dependencies as follows:

pkg install cmake

Even though FreeBSD provides a CAF port, VAST currently depends the CAF develop branch and therefore requires manual installation.

Linux

On recent Debian-based distributions, getting a working toolchain involves installing the following packages:

apt-get install cmake

CAF offers binary packages via openSUSE’s Build Service.

Mac OS

Mac OS also ships with a C++14 compiler out of the box. Homebrew makes it easy to install the dependencies:

brew install cmake
brew install caf --HEAD

Scientific Use

When referring to VAST in a scientific context, please use the following citation:

@InProceedings{nsdi16:vast,
  author    = {Matthias Vallentin and Vern Paxson and Robin Sommer},
  title     = {{VAST: A Unified Platform for Interactive Network Forensics}},
  booktitle = {Proceedings of the USENIX Symposium on Networked Systems
               Design and Implementation (NSDI)},
  month     = {March},
  year      = {2016}
}

You can download the paper from the NSDI ‘16 proceedings.

License

VAST comes with a 3-clause BSD licence.

Related Repositories

libtomcrypt

libtomcrypt

LibTomCrypt is a fairly comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptog ...

Phalanger

Phalanger

Full-featured PHP runtime & compiler for .NET/Mono frameworks. Phalanger is modern open-source implementation of PHP, compatible with the vast array of existing PHP code. In addition Phalanger gives PHP-application developers lot of new possibilities; lik ...

wowarmory

wowarmory

The World of Warcraft Armory is a vast searchable database of information for World of Warcraft - taken straight from the real servers and presented in a user-friendly interface. Since the Armory pulls its data from the actual game servers, it is the most ...

vast-video-js

vast-video-js

VAST-Ad plugin for HTML5 by video.js ...

trillian

trillian

Trillian is a project whose aim is to bridge the gap between astrophysical models and the vast amount of publicly available astronomical data. ...