Documentation

Quick Start with Pre-Built Image

The easiest way to run ShadowTap - no source code needed!

# Download configuration
curl -O https://raw.githubusercontent.com/StuartSpiegel/ShadowTap/main/website/downloads/docker-compose-prebuilt.yml

# Start ShadowTap
docker-compose -f docker-compose-prebuilt.yml up -d

# Access at http://localhost:8080

Or use Docker directly:

docker run -d \
  --name shadowtap \
  --network host \
  --cap-add NET_ADMIN \
  --cap-add NET_RAW \
  -e INTERFACE=eth0 \
  -v $(pwd)/data:/app/data \
  ghcr.io/stuartspiegel/shadowtap:latest

Image Location: ghcr.io/stuartspiegel/shadowtap:latest
Size: ~200-300MB compressed
Platforms: linux/amd64, linux/arm64

Docker Image Registry

Pre-built images available at: ghcr.io/stuartspiegel/shadowtap:latest

Detection Rules

Configuration files are included in the Docker image at /app/config/rules.yml

Enhanced Configuration

Advanced settings available at /app/config/enhanced_config.yml

Security Configuration

Authentication and SSL settings in /app/config/security_config.py

Ultra-Performance Guide

Enable high-throughput monitoring (200K+ pps) - documentation included in Docker image

Performance Configuration

Settings available at /app/config/ultra_performance.yml

Modular Architecture

ShadowTap features a modular design with separate packet capture, analysis, and dashboard components

Core Components

Real-time packet processing, threat detection engine, and interactive web dashboard

Built with Python

Core engine powered by Scapy, Flask, and high-performance packet processing libraries

Quality Assured

Comprehensive test coverage and continuous integration ensure reliability

Support

Contact via shadowtap.net for assistance and feature requests

Management Scripts

Docker Compose includes all necessary utility scripts and launchers

Testing Tools

Traffic generation and simulation tools included in the container