The programming model

The main motivation of Trisul Remote Protocol is to allow remote automation of forensics tasks. From a single workstation you can connect to any number of Trisul probes and run your custom analysis and forensics tools.

TRP is a message based request-response protocol. The protocol is built using Google Protocol Buffers which provides a language neutral, backward compatible, and compact format. You can write scripts in any language such as Ruby, Python, or Java by using the protocol definition file trp.proto and binding them to a language of your choice.

tip

All TRP messages are described in the TRP Messages and Fields page.

Request response

The Trisul Remote Protocol (known as TRP) provides an interface for clients to access the data collected by Trisul.

Key Features

• TRP is based on Protocol Buffers, a data interchange format introduced by Google.
• The entire protocol is specified in a single file called trp.proto.
• Allows clients to be written in Ruby/Python/Java/C#/C and any language supported by Google Protocol Buffers.
• Uses ZeroMQ sockets: a local ipc:// socket by default, or tcp:// for remote clients.
• Access to traffic stats, flow details, flow investigation features.

Synchronous operation

A client sends a request message to Trisul and waits for a response to that message. The typical steps a developer needs to do:

1. Construct a TRP message by filling in the appropriate fields.
2. Serialize the message.
3. Send it over the ZeroMQ socket set in the Hub's Server > ZmqConnection parameter.
4. Receive the response message and parse it.
5. Process the response as you see fit.

The trisulrp Ruby gem does steps 2 to 4 for you.