gurix/yoloyolo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: archive v1.2 milestone — Extended Protocol Coverage

Browse Source 
35 traffic classes across 9 protocol families shipped. Archives
ROADMAP, REQUIREMENTS, and phase directories to milestones/v1.2-*.
Updates README with new protocol families, sound design table,
and [groups] TOML config documentation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
gurix
2026-03-27 16:48:53 +01:00
co-authored by Claude Opus 4.6
parent 0a4d48c9c1
commit 494385b528
42 changed files with 290 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+43 -19
View File
@@ -2,7 +2,7 @@
**Turn network traffic into ambient sound.**
NetSynth captures live network traffic (or reads pcap files), classifies packets by protocol, and synthesizes an ambient MP3 soundscape where each traffic type produces a distinct harmonic drone. A ping sounds different from HTTPS noise, which sounds different from a port scan.
NetSynth captures live network traffic (or reads pcap files), classifies packets into 35 protocol families, and synthesizes an ambient MP3 soundscape where each traffic type produces a distinct harmonic drone. A ping sounds different from HTTPS noise, which sounds different from a port scan.
Run it, let it listen, press Ctrl+C, get an audio fingerprint of your network.
@@ -133,7 +133,19 @@ waveform = "square"
### Available Traffic Classes
`ICMP`, `DNS`, `HTTPS`, `HTTP`, `SSH`, `SMTP`, `NTP`, `DHCP`, `OtherTCP`, `OtherUDP`, `Unknown1`, `Unknown2`, `Unknown3`, `Unknown4`
35 built-in classes organized by protocol family:
| Family | Classes |
|--------|---------|
| Infrastructure | `ICMP`, `DNS`, `NTP`, `DHCP`, `mDNS`, `SSDP`, `SNMP`, `LDAP`, `Kerberos`, `Syslog` |
| Web | `HTTPS`, `HTTP`, `QUIC` |
| Mail | `SMTP`, `IMAP`, `POP3`, `SMTP-Sub` |
| Remote Access | `SSH`, `RDP`, `Telnet`, `VNC` |
| File Transfer | `FTP`, `SMB`, `TFTP` |
| Database | `MySQL`, `PostgreSQL`, `Redis`, `MongoDB` |
| Discovery | `mDNS`, `SSDP`, `SNMP` |
| VoIP | `SIP` |
| Unknown | `OtherTCP`, `OtherUDP`, `Unknown1`-`Unknown4` |
### Available Waveforms
@@ -168,7 +180,7 @@ frequency = 1500.0
waveform = "sawtooth"
```
Custom classes that don't have a `[sounds.*]` entry automatically get a unique frequency in the 1200-2350 Hz range.
Custom classes that don't have a `[sounds.*]` entry automatically get a unique frequency in the 2500-4000 Hz range.
### Print Config
@@ -185,7 +197,19 @@ netsynth --config my-sounds.toml --print-config
netsynth --print-config > template.toml
```
The output includes `(default)`, `(override)`, and `(auto-assigned)` annotations so you can see what's customized.
The output includes `(default)`, `(override)`, and `(auto-assigned)` annotations so you can see what's customized. Classes are grouped by protocol family with section headers.
### Group Reassignment
You can reassign protocols to different sound families using the `[groups]` table:
```toml
[groups]
DNS = "Web" # Move DNS from Infrastructure to Web family
SIP = "Infrastructure" # Move SIP from VoIP to Infrastructure
```
Reassigned protocols inherit the waveform character of their new family in `--print-config` output.
### Validation
@@ -203,7 +227,7 @@ Capture -> Classify -> Aggregate -> Synthesize -> MP3
1. **Capture** — Packets are read from a live interface (via [go-pcap](https://github.com/packetcap/go-pcap)) or a pcap file. Optional BPF filtering reduces the stream to traffic of interest.
2. **Classify** — Each packet is matched against protocol rules (ICMP, DNS, HTTPS, SSH, HTTP, SMTP, NTP, DHCP, etc.) plus any user-defined rules from the config file. User rules fire first. Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
2. **Classify** — Each packet is matched against 35 built-in protocol rules across 9 families (Infrastructure, Web, Mail, Remote Access, File Transfer, Database, Discovery, VoIP) plus any user-defined rules from the config file. User rules fire first. Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
3. **Aggregate** — Classified packets are grouped into 500ms time windows. Each window records per-protocol packet counts that drive synthesis amplitudes.
@@ -211,21 +235,21 @@ Capture -> Classify -> Aggregate -> Synthesize -> MP3
### Sound Design
| Traffic Class | Frequency | Character |
|--------------|-----------|-----------|
| ICMP (Ping) | 65 Hz | Deep, distinctive ping tone |
| DNS | 110 Hz | Quick lookup sound |
| HTTPS/TLS | 175 Hz | Steady drone (bulk traffic) |
| HTTP | 220 Hz | Warm web traffic hum |
| SSH | 330 Hz | Distinct interactive tone |
| SMTP | 440 Hz | Mail delivery tone |
| NTP | 520 Hz | Time sync pulse |
| DHCP | 600 Hz | Network setup sound |
| Other TCP | 700 Hz | Generic TCP hum |
| Other UDP | 780 Hz | Generic UDP hum |
| Unknown 1-4 | 862–1047 Hz | Dissonant, attention-grabbing |
Protocols are grouped into families that share a waveform type and frequency register, making related traffic sound cohesive while remaining distinguishable. Frequencies follow a major-second ladder within each family.
Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity. All frequencies and waveforms can be overridden via the [config file](#custom-sound-configuration).
| Family | Waveform | Frequency Range | Protocols |
|--------|----------|----------------|-----------|
| Infrastructure | Triangle | 65-133 Hz | ICMP, NTP, DHCP, mDNS, SSDP, SNMP, DNS |
| Web | Sawtooth | 150-190 Hz | HTTPS, HTTP, QUIC |
| Mail | Triangle | 214-305 Hz | SMTP, IMAP, POP3, SMTP-Sub |
| Remote Access | Square | 343-485 Hz | SSH, RDP, Telnet, VNC |
| File Transfer | Square | 545-687 Hz | FTP, SMB, TFTP |
| Unknown | Custom | 771-1375 Hz | Unknown1-4, OtherTCP, OtherUDP |
| Database | Sawtooth | 1543-2182 Hz | MySQL, PostgreSQL, Redis, MongoDB |
| VoIP | Sine | 2449 Hz | SIP |
| Infrastructure (ext.) | Triangle | 2950-3250 Hz | LDAP, Kerberos, Syslog |
Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity. All frequencies, waveforms, and group assignments can be overridden via the [config file](#custom-sound-configuration).
## Project Structure