Kusanagi Kajiki 草薙カジキ

Modern ICS/SCADA passive network discovery and topology visualization tool.

A ground-up rewrite of the NSA's GRASSMARLIN (archived 2023), rebuilt with Tauri 2.0 (Rust backend) and SvelteKit (TypeScript frontend) for performance, security, and cross-platform support.

The name is a bilingual nod to the original: 草 (kusa/grass) + marlin (kajiki/カジキ), with Kusanagi (草薙) referencing the legendary Japanese sword.

Active Development — This project is under active development. See the Roadmap for current status.

What It Does

Kusanagi Kajiki passively discovers and maps Industrial Control System (ICS) and SCADA network devices by analyzing network traffic. It is designed for OT security assessments where active scanning is not an option — maintaining availability of industrial systems is paramount.

Core Capabilities

• PCAP Import — Analyze captured traffic offline with multi-file support
• Live Capture — Real-time packet capture with streaming topology updates
• Three Topology Views — Logical (subnet-grouped), Physical (switch port mapping), and Mesh (Sniffles all-to-all)
• YAML Signature Engine — 54+ extensible fingerprint signatures identifying specific vendor products (not just protocols), with confidence scoring 1-5
• Deep Protocol Parsing — Modbus function codes, DNP3 object types, register mapping, device identification extraction
• Physical Topology — Import Cisco configs, CAM tables, and CDP neighbors to map devices to physical switch ports
• Asset Inventory — Searchable database with vendor-specific identification, MAC OUI lookup, and GeoIP for public IPs
• MITRE ATT&CK for ICS — Map observed behaviors to ATT&CK techniques with severity ratings
• Purdue Model Overlay — Auto-assign Purdue levels, detect and flag cross-zone policy violations
• Anomaly Scoring — Detect role reversals, polling deviations, unexpected devices, and unencrypted OT traffic
• External Tool Integration — Import Zeek logs, Suricata EVE JSON, Nmap XML. Right-click to open in Wireshark.
• PDF Assessment Reports — One-click professional reports with executive summary, topology diagrams, findings, and recommendations
• SBOM Export — CISA BOD 23-01 aligned asset inventories for federal compliance
• Baseline Drift Detection — Diff current assessment against previous baseline, highlight changes
• Plugin Architecture — Extensible via signature packs, importers, exporters, and analyzers

Supported ICS Protocols

Signature-Identified Products (partial list)

Rockwell ControlLogix, Schneider Modicon M340/Unity, Siemens S7-300/400/1200/1500, ABB 800xA, Honeywell Experion, Emerson DeltaV, GE SRTP devices, Wonderware SuiteLink, CODESYS controllers, and more via the extensible YAML signature engine.

Architecture

┌────────────────────────────────────────────────────────────┐
│  SvelteKit Frontend (Tauri Webview)                        │
│  ├── Logical / Physical / Mesh topology views              │
│  ├── Asset inventory, protocol stats, findings panel       │
│  ├── Signature editor, report builder, Purdue overlay      │
│  └── Settings, timeline scrubber, baseline diff            │
├────────────────────────────────────────────────────────────┤
│  Tauri IPC (Commands + Event Streaming)                    │
├────────────────────────────────────────────────────────────┤
│  Rust Backend                                              │
│  ├── gm-capture     (pcap + etherparse)                    │
│  ├── gm-parsers     (protocol ID + deep parsing)           │
│  ├── gm-signatures  (YAML fingerprint engine)              │
│  ├── gm-topology    (petgraph logical graph)               │
│  ├── gm-physical    (Cisco config → physical topology)     │
│  ├── gm-ingest      (Zeek, Suricata, Nmap importers)      │
│  ├── gm-analysis    (ATT&CK, Purdue, anomaly, TLS)        │
│  ├── gm-report      (PDF, SBOM, STIX 2.1)                 │
│  └── gm-db          (SQLite persistence)                   │
└────────────────────────────────────────────────────────────┘

Getting Started

Prerequisites

• Rust >= 1.77 — Install via rustup
• Node.js >= 22 — Install via nvm
• libpcap development headers

Platform-specific dependencies

Linux (Ubuntu/Debian):

sudo apt install libpcap-dev libwebkit2gtk-4.1-dev \
  libappindicator3-dev librsvg2-dev patchelf

macOS:

brew install libpcap
xcode-select --install

Windows:

• Install Npcap (check "Install Npcap in WinPcap API-compatible Mode")
• Download the Npcap SDK and add Lib/x64 to your LIB environment variable

Build & Run

# Clone the repository
git clone https://github.com/YOUR_USERNAME/kusanagi-kajiki.git
cd kusanagi-kajiki

# Install frontend dependencies
npm install

# Run in development mode (hot-reload)
npm run tauri dev

# Build for production
npm run tauri build

Running Without Root (Linux)

For live capture without running as root:

sudo setcap cap_net_raw,cap_net_admin=eip src-tauri/target/release/kusanagi-kajiki

Usage

PCAP Import

1. Navigate to the Capture tab
2. Click Import PCAP File(s) — multi-select supported
3. View results across Topology, Inventory, and Protocol Stats tabs
4. Connection tree panel shows per-node expandable packet details with origin file tracking

Cisco Config Import (Physical Topology)

1. Navigate to Physical View
2. Import Cisco IOS configs, show mac address-table, show cdp neighbors, and show arp output
3. Physical topology renders switch port assignments — "PLC on Gi1/0/14 of SW-PLANT-3"

Zeek / Suricata Import

1. Navigate to Capture tab
2. Click Import Zeek Logs or Import Suricata EVE
3. Select conn.log, modbus.log, dnp3.log, or eve.json
4. Data feeds into the same topology and asset pipeline as PCAP

Assessment Report

1. Complete your analysis (PCAP import, signature matching, Purdue assignment)
2. Navigate to Report tab
3. Configure branding, assessor name, client name
4. Click Generate PDF — produces a professional report with executive summary, topology diagram, asset inventory, protocol analysis, findings, and recommendations

Test Data

Public ICS PCAP samples for testing:

• automayt/ICS-pcap — Curated Modbus, DNP3, EtherNet/IP, S7comm, BACnet captures
• Wireshark Sample Captures — Various protocol samples
• 4SICS Geek Lounge — Real ICS network traffic

Roadmap

Development follows a phased plan. Phases 0–7 achieve GRASSMARLIN feature parity. Phases 8–11 go beyond the original.

See CLAUDE.md for the full specification with detailed checklists per phase.

GRASSMARLIN Feature Parity

Kusanagi Kajiki implements every major GRASSMARLIN 3.2 feature:

Beyond GRASSMARLIN — New Capabilities

Contributing

This project is currently in early development. Contributions welcome once the core architecture stabilizes (Phase 3+).

Areas where contributions would be most valuable:

• YAML signatures — If you work with ICS/SCADA protocols, writing new fingerprint signatures for vendor products
• Test PCAPs — Sanitized ICS network captures for the test suite
• Protocol parsers — Deep parsing for protocols beyond Modbus/DNP3 (BACnet, EtherNet/IP, S7comm, OPC UA)

Acknowledgments

• NSA Cybersecurity — Original GRASSMARLIN tool and concept
• Step Function I/O — rodbus and dnp3 Rust crates
• Tauri — Cross-platform desktop app framework
• Cytoscape.js — Network graph visualization
• MITRE — ATT&CK for ICS framework

License

Apache License 2.0 — See LICENSE for details.

This is an independent project inspired by GRASSMARLIN. It contains no original GRASSMARLIN source code.