lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue Jun 20 02:45:40 2006 From: joel at helgeson.com (Joel R. Helgeson) Subject: tcpdump logfile viewer I have written a perl script that churns through tcpdump files and generates reports on the data. When I do a security audit, one thing I do is a 24 hour packet capture, where I plug my Linux box into the core switch and mirror all traffic on the core to my linux box where I run: tcpdump -n -q >capture.file Then I run dumpscan.pl capture.file I gather 24 hours of data, which sometimes is several hundred gigs of data, then I run it through my perl script which generates my reports. I take these raw traffic reports and plug them into excel where I generate these charts and graphs. (See Attached) I also tossed these files up to my site - http://www.appiant.net/audit so anyone can download them. If you use it, and you like it, drop me a note. Joel ----- Original Message ----- From: Aaron Gray To: Full Disclosure Sent: Sunday, June 18, 2006 5:01 PM Subject: [Full-disclosure] tcpdump logfile viewer Are there any viewers for tcpdump log files ? 1) a) On Linux b) on Windows c) as an HTML server 2) a) text dump file b) binary dump file Aaron ------------------------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/attachment-0001.html -------------- next part -------------- A non-text attachment was scrubbed... Name: Traffic-Types.gif Type: image/gif Size: 12159 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Traffic-Types-0001.gif -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: dumpscan.txt Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/dumpscan-0001.txt -------------- next part -------------- A non-text attachment was scrubbed... Name: Time.gif Type: image/gif Size: 25023 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Time-0001.gif -------------- next part -------------- A non-text attachment was scrubbed... Name: Top-Talkers.gif Type: image/gif Size: 19289 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-Talkers-0001.gif -------------- next part -------------- A non-text attachment was scrubbed... Name: Top-TCP-Talkers.gif Type: image/gif Size: 18003 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-TCP-Talkers-0001.gif -------------- next part -------------- A non-text attachment was scrubbed... Name: Top-UDP-Talkers.gif Type: image/gif Size: 18858 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-UDP-Talkers-0001.gif
Powered by blists - more mailing lists