The latest articles on DEV Community by tcpcat (@tcpcat). https://dev.to/tcpcat https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4155716%2F92d366ba-3085-4e6c-9fcd-f88832774eae.jpg https://dev.to/tcpcat en tcpcat Thu, 01 Oct 2026 19:37:25 +0000 https://dev.to/tcpcat/tcpcat-an-open-source-network-recon-engine-in-go-with-ebpfafxdp-and-wasm-detection-4i31 https://dev.to/tcpcat/tcpcat-an-open-source-network-recon-engine-in-go-with-ebpfafxdp-and-wasm-detection-4i31 <p>I've been building <strong>tcpcat</strong>, a network reconnaissance and vulnerability-intelligence engine written in Go. It's meant for learning, network administration and <strong>authorized</strong> security testing, and it's free and open source under the AGPL-3.0.</p> <p>👉 <strong>Repo:</strong> <a href="https://github.com/NycolazSec/tcpcat" rel="noopener noreferrer">https://github.com/NycolazSec/tcpcat</a></p> <h2> Why I built it </h2> <p>I wanted one tool that could enumerate a network, fingerprint what it finds, correlate it with known CVEs, and let me check whether my IDS/IPS actually sees what it should, without stitching together five different programs.</p> <h2> What it does </h2> <p><strong>L2–L7 reconnaissance</strong></p> <ul> <li>Multi-protocol port enumeration (TCP, UDP, ICMP)</li> <li>Service topology mapping with version fingerprinting</li> <li>Asynchronous DNS / mDNS / NetBIOS discovery</li> </ul> <p><strong>CVE correlation</strong></p> <ul> <li>Vulners API, Google OSV, or an offline database</li> </ul> <p><strong>Assessment controls for testing monitoring visibility</strong></p> <ul> <li>Timing jitter, IPv4 fragmentation, decoy traffic, TCP/UDP window tuning, source-port selection</li> </ul> <p><strong>Programmable detection with WebAssembly</strong></p> <ul> <li>Write detection rules and protocol dissectors in Rust, C, Go or AssemblyScript</li> <li>Scripts run in a sandbox, so a bad plugin can't take the engine down</li> </ul> <h2> Performance </h2> <p>On Linux (kernel 5.8+), tcpcat can use <strong>eBPF / AF_XDP</strong> to do packet I/O at the driver level and bypass the socket layer. That's what makes high-throughput scanning possible (around 1M packets per second per core). It's optional, and tcpcat works without it.</p> <h2> Getting started </h2> <p>Requirements: Go 1.26+. Pre-built packages are available for macOS (<code>.dmg</code>) and Debian/Ubuntu (<code>.deb</code>) on the <a href="https://github.com/NycolazSec/tcpcat/releases" rel="noopener noreferrer">releases page</a>.<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>git clone https://github.com/NycolazSec/tcpcat.git <span class="nb">cd </span>tcpcat make </code></pre> </div> <h2> Licensing </h2> <p>tcpcat is dual-licensed: <strong>AGPL-3.0</strong> for open-source use, and a commercial (OEM) license if you want to embed it in a proprietary product or hosted service. There is no hosted scanning service and no paid support.</p> <h2> Responsible use </h2> <p>Only scan networks you own or have written permission to test.</p> <h2> Feedback welcome </h2> <p>I'd especially like feedback on the WASM plugin API and on which detection rules would be most useful to ship by default. Issues, stars and PRs are all appreciated: <a href="https://github.com/NycolazSec/tcpcat" rel="noopener noreferrer">https://github.com/NycolazSec/tcpcat</a></p> go security networking opensource