logisek/baconsamplerSniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
Sniffs outbound traffic for suspicious, beacon-like callbacks, because if it keeps coming back on schedule, it's probably not breakfast.
Bacon Sampler is a lightweight outbound-connection catcher that sniffs the sizzle of your network traffic and flags suspicious "beacon-like" behavior - those periodic, low-and-slow callbacks that malware loves to phone home with.
It passively monitors outbound connections and DNS lookups, then highlights patterns like steady intervals, repeated destinations, weird jitter, and consistent byte sizes, basically anything that looks less like normal browsing and more like a bot checking in for instructions.
Think of it as a Beacon Scanner, but tastier: if something keeps coming back at the same time every time... we're sampling the bacon.
.mmdb) or DB-IP Lite (.mmdb).BIN)pip install -r requirements.txt
Download a GeoIP database and note the path:
.mmdb).BIN)If you prefer a free online lookup, you can skip this and use --geoip-online.
List interfaces:
python capture_outbound.py --list-interfaces
Pick an interface by index:
python capture_outbound.py --interface 0
Use multiple interfaces (repeatable):
python capture_outbound.py --interface "Ethernet" --interface "Wi-Fi"
Or with comma-separated names:
python capture_outbound.py --interfaces "Ethernet,Wi-Fi"
Pcap-only capture (A) with offline GeoIP:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --geoip-db "C:\Path\GeoLite2-Country.mmdb"
Pcap + netstat correlation (B) with offline GeoIP:
python capture_outbound.py --mode pcap_plus_netstat --duration 20 --interface "Ethernet" --geoip-db "C:\Path\GeoLite2-Country.mmdb"
Pcap + netstat union (A+B):
python capture_outbound.py --mode both --duration 20 --interface "Ethernet" --geoip-db "C:\Path\GeoLite2-Country.mmdb"
Online GeoIP (free, rate-limited, cached to disk):
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --geoip-online ipapi
Online GeoIP with IPinfo token:
$env:IPINFO_TOKEN="your_token_here"
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --geoip-online ipinfo
Or pass the token explicitly:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --geoip-online ipinfo --geoip-online-token "your_token_here"
Tune online GeoIP timeout and retries:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --geoip-online ipapi --geoip-timeout 2.5 --geoip-retries 1
Disable reverse DNS (faster runs):
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --no-dns
Tune DNS timeout:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --dns-timeout 0.5
Limit capture by packet count:
python capture_outbound.py --mode pcap --duration 60 --packet-limit 5000
Filter by protocol, remote port, and IP CIDR:
python capture_outbound.py --filter-protocol tcp --filter-port 80,443,1000-2000 --allow-ip 1.2.3.0/24 --deny-ip 1.2.3.4/32
Group summaries and top N:
python capture_outbound.py --group-by remote_ip,process --top 10
Track total bytes per connection:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --track-bytes
Disable progress output:
python capture_outbound.py --no-progress
Disable console output:
python capture_outbound.py --no-console
Pcap + netstat union (A+B) + Online GeoIP + Write a pcap + CSV + HTML:
python capture_outbound.py --mode both --duration 20 --interface "Ethernet,Wi-Fi" --geoip-online ipapi --pcap-out "C:\Path\capture.pcap" --csv "C:\Path\outbound.csv" --html "C:\Path\outbound.html"
Pcap-only + output folder + custom CSV/JSON names:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --output-dir "C:\Path\Reports" --csv "C:\Path\Reports\outbound.csv" --json "C:\Path\Reports\outbound.json"
Beacon-like activity detection (low-and-slow callbacks):
python capture_outbound.py --duration 300 --beacon-min-duration 120 --beacon-min-interval 60 --beacon-max-interval 1800 --beacon-max-jitter 10 --beacon-min-packets 6 --beacon-max-rate 0.05
Pattern detection (steady intervals, jitter, repeated destinations, consistent sizes):
python capture_outbound.py --duration 300 --track-bytes --pattern-high-jitter 120 --pattern-repeat-destination 4 --pattern-max-byte-jitter 64 --dns-pattern-min-queries 4
Tight beacon + pattern thresholds with filtering:
python capture_outbound.py --duration 600 --filter-protocol tcp --filter-port 443 --track-bytes --beacon-min-duration 180 --beacon-min-interval 90 --beacon-max-interval 900 --beacon-max-jitter 5 --beacon-min-packets 8 --pattern-high-jitter 60 --pattern-repeat-destination 5 --pattern-max-byte-jitter 32
DNS-focused capture (fast DNS lookup + DNS patterns):
python capture_outbound.py --duration 180 --dns-timeout 0.25 --dns-pattern-min-queries 5 --pattern-repeat-destination 3
outbound_connections.csvoutbound_connections.json--html "report.html"*_beacon_findings.csv / *_beacon_findings.json*_connection_patterns.csv / *_connection_patterns.json*_dns_patterns.csv / *_dns_patterns.json*_unique_connections.csv / *_unique_connections.json*_unique_processes.csv / *_unique_processes.json*_group_remote_ip*.csv/json, *_group_process*.csv/json, *_group_country*.csv/jsonCustom CSV/JSON output paths:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --csv "C:\Path\outbound.csv" --json "C:\Path\outbound.json"
Send all outputs to a folder:
python capture_outbound.py --mode pcap --duration 20 --output-dir "C:\Path\Reports"
Write HTML output:
python capture_outbound.py --html "outbound.html"
Write a pcap file:
python capture_outbound.py --mode pcap --duration 20 --interface "Ethernet" --pcap-out "capture.pcap"