full-disclosure - tcpdump logfile viewer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue Jun 20 02:45:40 2006
From: joel at helgeson.com (Joel R. Helgeson)
Subject: tcpdump logfile viewer

I have written a perl script that churns through tcpdump files and generates reports on the data.
When I do a security audit, one thing I do is a 24 hour packet capture, where I plug my Linux box into the core switch and mirror all traffic on the core to my linux box where I run:

tcpdump -n -q >capture.file

Then I run

dumpscan.pl capture.file

I gather 24 hours of data, which sometimes is several hundred gigs of data, then I run it through my perl script which generates my reports.  I take these raw traffic reports and plug them into excel where I generate these charts and graphs. (See Attached)

I also tossed these files up to my site - http://www.appiant.net/audit so anyone can download them.  

If you use it, and you like it, drop me a note.

Joel
  ----- Original Message ----- 
  From: Aaron Gray 
  To: Full Disclosure 
  Sent: Sunday, June 18, 2006 5:01 PM
  Subject: [Full-disclosure] tcpdump logfile viewer


  Are there any viewers for tcpdump log files ?

  1)
      a) On Linux
      b) on Windows
      c) as an HTML server
  2)
      a) text dump file
      b) binary dump file

  Aaron



------------------------------------------------------------------------------


  _______________________________________________
  Full-Disclosure - We believe in it.
  Charter: http://lists.grok.org.uk/full-disclosure-charter.html
  Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/attachment-0001.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Traffic-Types.gif
Type: image/gif
Size: 12159 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Traffic-Types-0001.gif
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dumpscan.txt
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/dumpscan-0001.txt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Time.gif
Type: image/gif
Size: 25023 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Time-0001.gif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Top-Talkers.gif
Type: image/gif
Size: 19289 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-Talkers-0001.gif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Top-TCP-Talkers.gif
Type: image/gif
Size: 18003 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-TCP-Talkers-0001.gif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Top-UDP-Talkers.gif
Type: image/gif
Size: 18858 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-UDP-Talkers-0001.gif