gurix
b9ec05aebc
- 9 table-driven tests covering CFG-01 through CFG-05 - TestLoadPartialOverrideFrequency, TestLoadPartialOverrideWaveform, TestLoadBothOverrides - TestLoadUnknownKey, TestLoadNoConfig, TestLoadExplicitMissing - TestLoadUnknownClass, TestLoadInvalidWaveform, TestLoadAllDefaultsPresent - Stub config.Load returns nil,nil — all tests fail (RED)
NetSynth
Turn network traffic into ambient sound.
NetSynth captures live network traffic (or reads pcap files), classifies packets by protocol, and synthesizes an ambient MP3 soundscape where each traffic type produces a distinct harmonic drone. A ping sounds different from HTTPS noise, which sounds different from a port scan.
Run it, let it listen, press Ctrl+C, get an audio fingerprint of your network.
Quick Start
# Live capture on eth0 (requires root or CAP_NET_RAW)
sudo netsynth -i eth0
# Press Ctrl+C after a few seconds → saves netsynth-<timestamp>.mp3
# Sonify a pcap file (no privileges needed)
netsynth --read capture.pcap -o output.mp3
# Filter to DNS traffic only
sudo netsynth -i eth0 --filter "port 53" -o dns.mp3
Installation
Prerequisites
- Go 1.24+
- C compiler (GCC or Clang) — required for MP3 encoding (CGo)
Build from Source
git clone https://codeberg.org/gurix/yoloyolo.git
cd yoloyolo
go build -o netsynth ./cmd/netsynth
For a smaller binary:
go build -ldflags="-s -w" -o netsynth ./cmd/netsynth
Privileges
Live packet capture requires elevated privileges on Linux:
# Option A: run as root
sudo ./netsynth -i eth0
# Option B: grant capability (preferred)
sudo setcap cap_net_raw=eip ./netsynth
./netsynth -i eth0
Usage
netsynth [flags]
| Flag | Description |
|---|---|
-i, --interface |
Network interface to capture on |
--read |
Read packets from a pcap file instead of live capture |
-o, --output |
Output MP3 file path (default: netsynth-<timestamp>.mp3) |
--filter |
BPF filter expression, tcpdump syntax (e.g. "port 53") |
--verbose |
Print per-window protocol activity to stderr |
--list-interfaces |
List available network interfaces and exit |
Examples
# Capture all traffic, verbose per-window output
sudo netsynth -i wlan0 --verbose
# Only HTTPS traffic
sudo netsynth -i eth0 --filter "tcp port 443" -o https.mp3
# Sonify a Wireshark capture (output derived: capture.pcap -> capture.mp3)
netsynth --read capture.pcap
# Filter a pcap file to UDP only
netsynth --read traffic.pcap --filter "udp" -o udp-only.mp3
How It Works
NetSynth processes traffic through a four-stage pipeline:
Capture -> Classify -> Aggregate -> Synthesize -> MP3
-
Capture — Packets are read from a live interface (via go-pcap) or a pcap file. Optional BPF filtering reduces the stream to traffic of interest.
-
Classify — Each packet is matched against 12 protocol rules (ICMP, DNS, HTTPS, SSH, HTTP, SMTP, NTP, DHCP, etc.). Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
-
Aggregate — Classified packets are grouped into 500ms time windows. Each window records per-protocol packet counts that drive synthesis amplitudes.
-
Synthesize & Encode — Each traffic class maps to a sine oscillator at a specific frequency and stereo position. Amplitudes rise and fall via EMA smoothing based on traffic volume. All layers are mixed and encoded to MP3 via LAME.
Sound Design
| Traffic Class | Frequency Range | Character |
|---|---|---|
| ICMP (Ping) | High register | Bright, distinctive ping tone |
| DNS | Mid-high | Quick lookup sound |
| HTTPS/TLS | Low register | Deep, steady drone (bulk traffic) |
| SSH | Mid register | Distinct interactive tone |
| HTTP | Low-mid | Warm web traffic hum |
| Unknown 1-4 | Dissonant | Eerie, attention-grabbing |
Sustained traffic sounds louder; quiet periods fade to silence. The result is a unique audio fingerprint of your network activity.
Project Structure
cmd/netsynth/ CLI entry point (Cobra)
capture/ Packet capture, BPF validation, pcap file reading
classify/ Protocol classification rules and types
aggregate/ Time-window aggregation and summary output
synth/ Oscillators, EMA layers, stereo mixer, tone bank
encode/ MP3 encoding via embedded LAME
Dependencies
| Library | Purpose |
|---|---|
| gopacket/gopacket | Packet decoding |
| packetcap/go-pcap | Pure Go live capture (no libpcap) |
| sjzar/go-lame | MP3 encoding (embedded LAME C source) |
| spf13/cobra | CLI framework |
No runtime dependencies beyond the compiled binary. CGo is required at build time only (for LAME).
Testing
go test ./... -v
All tests run without root privileges (capture tests use mock data and programmatically generated pcap files).
License
See LICENSE for details.