Programs to analyze pcap file and extract flow statistics, identification, HTTP protocol fields in a batch mode.

by chenxm

2013-03

Your systems should have the standard tcptrace, tstat, justniffer installed and their binary files called with $PATH variables (ex. /usr/bin).

New version of pcapDPI (binary file has been delivered along with the project)

pcap-workflow.sh combines the analysis from a pcap trace to precisely formated logs in .csv format. The workflow aggerates following processing:

|tcptrace on pcap| --> |tstat on pcap| --> |merge tcptrace and tstat outputs| -->

|justniffer on pcap| -->

|pcapDPI on pcap| -->

|format the outputs all above|

batch-tcpprep.sh: a wrapper of tcpprep (an utility of tcpreplay to generate cache file used by main programs) to generate cache files for multiple pcap files with one line command.

batch-tcpreplay.sh: a wrapper of tcpreplay to replay multiple pcap files with one line command. It must work after the batch tcpprep wrapper.

captcp.py: a borrowed tool from: http://research.protocollabs.com/captcp/

pcap-split-client-server.py: split pcap traces into client and server sides by indicating client/server networks. If only the --client network is explicit, the packets with source IP belonging to the network are classified as client while all the others are classified as the server side. It's the same that only --server network is explicit. If the --client and --server are both explicit, the packets with source IP belonging to the client AND destination IP belonging to the server are classified as client; the packets with reversed direction are classified as server side; and the left is ignored.

pcap-split-fixed-size.sh: a preprocessing tool for hadoop to prepare fixed-size input pcap files. Each split file is with some fixed size, the default being 64MB.