PortScope

PortScope is a lightweight, terminal-based TCP listener and protocol sniffer built with Go. It allows developers to listen on any port, capture incoming traffic, and automatically identify common protocols (HTTP, SSH, TLS, Redis, etc.) in real-time.

Built with Bubble Tea 🫧.

✨ Features

Real-time Sniffing: Listen to incoming TCP connections and view the payload immediately.
Protocol Detection: Automatically identifies headers for HTTP, HTTPS/TLS, SSH, IRC, and Redis.
Dynamic Port Switching: Change the listening port on the fly without restarting the application.
File Logging: Toggle recording to save captured traffic to a local log file.
Interactive TUI: Full mouse support, scrollable history, and responsive layout.

🚀 Installation

Prerequisites

You need Go 1.18+ installed on your machine.

Build from source

Clone the repository (or create the directory):
```
mkdir portscope && cd portscope
```

Initialize the module and install dependencies:

go mod init portscope
go get github.com/charmbracelet/bubbletea
go get github.com/charmbracelet/bubbles/viewport
go get github.com/charmbracelet/bubbles/textinput
go get github.com/charmbracelet/lipgloss

Run the application:
```
go run main.go
```

🎮 Usage

Once the application is running, it defaults to listening on Port 8080.

Key Controls

Key	Action
`p`	Change Port: Opens an input box to switch the listener to a new port.
`s`	Toggle Recording: Enables/Disables saving logs to `portscope.log`.
`q` / `Ctrl+C`	Quit: Exits the application.
Mouse Wheel	Scroll: Scroll up and down through the traffic history.

Testing the Listener

You can test PortScope using curl or netcat in a separate terminal window:

HTTP:

curl -d "Hello PortScope" http://localhost:8080

HTTPS (TLS Handshake detection):

curl -k https://localhost:8080

Raw TCP:

echo "SECRET_DATA" | nc localhost 8080

🔍 Supported Protocols

PortScope inspects the first few bytes of the incoming packet to determine the protocol. Currently supported signatures:

HTTP (Methods: GET, POST, PUT, DELETE, etc.)
HTTPS (TLS Client Hello 0x16)
SSH (SSH- Header)
IRC (NICK/USER commands)
REDIS (RESP Array/String markers)
UNKNOWN (Raw TCP data)

📸 Preview

PORTSCOPE  Listening on :8080
────────────────────────────────────────────────────────
10:15:02  [HTTP]   127.0.0.1:54321       GET / HTTP/1.1 User-Agent: curl...
10:15:05  [SSH]    192.168.1.50:60112    SSH-2.0-OpenSSH_8.9p1...
10:15:10  [REDIS]  127.0.0.1:54325       *2 $3 GET $3 foo...
────────────────────────────────────────────────────────
● REC                               q: quit • p: change port • s: toggle save