diff --git a/doc/reanalyzing.md b/doc/reanalyzing.md index 320c288..08f55b9 100644 --- a/doc/reanalyzing.md +++ b/doc/reanalyzing.md @@ -16,11 +16,30 @@ using the `rayhunter-check` CLI tool. That tool contains the same heuristics as Rayhunter and will also work on traffic data captured with other tools, such as QCSuper. -You need Rust installed and the rayhunter repository checked out: - -```sh -cargo run -p rayhunter-check -- --path ~/Downloads/myfile.qmdl -cargo run -p rayhunter-check -- --path ~/Downloads/myfile.pcap -``` - Since, 0.7.0, `rayhunter-check` is included in the release zipfile. + +You can build `rayhunter-check` from source with the following command: +`cargo build --bin rayhunter-check` + +## Usage +```sh +rayhunter-check [OPTIONS] --path + +Options: + -p, --path Path to the PCAP, or QMDL file. If given a directory will + recursively scan all pcap, qmdl, and subdirectories + -P, --pcapify Turn QMDL file into PCAP + --show-skipped Show skipped messages + -q, --quiet Print only warnings + -d, --debug Print debug info + -h, --help Print help + -V, --version Print version +``` +### Examples +`rayhunter-check -p ~/Downloads/myfile.qmdl` + +`rayhunter-check -p ~/Downloads/myfile.pcap` + +`rayhunter-check -p ~/Downloads #Check all files in downloads` + +`rayhunter-check -d -p ~/Downloads/myfile.qmdl #run in debug mode` \ No newline at end of file