[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <004c01c693c0$0b4282f0$1400a8c0@appiant>
Date: Tue Jun 20 02:45:40 2006
From: joel at helgeson.com (Joel R. Helgeson)
Subject: tcpdump logfile viewer
I have written a perl script that churns through tcpdump files and generates reports on the data.
When I do a security audit, one thing I do is a 24 hour packet capture, where I plug my Linux box into the core switch and mirror all traffic on the core to my linux box where I run:
tcpdump -n -q >capture.file
Then I run
dumpscan.pl capture.file
I gather 24 hours of data, which sometimes is several hundred gigs of data, then I run it through my perl script which generates my reports. I take these raw traffic reports and plug them into excel where I generate these charts and graphs. (See Attached)
I also tossed these files up to my site - http://www.appiant.net/audit so anyone can download them.
If you use it, and you like it, drop me a note.
Joel
----- Original Message -----
From: Aaron Gray
To: Full Disclosure
Sent: Sunday, June 18, 2006 5:01 PM
Subject: [Full-disclosure] tcpdump logfile viewer
Are there any viewers for tcpdump log files ?
1)
a) On Linux
b) on Windows
c) as an HTML server
2)
a) text dump file
b) binary dump file
Aaron
------------------------------------------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/attachment-0001.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Traffic-Types.gif
Type: image/gif
Size: 12159 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Traffic-Types-0001.gif
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: dumpscan.txt
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/dumpscan-0001.txt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Time.gif
Type: image/gif
Size: 25023 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Time-0001.gif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Top-Talkers.gif
Type: image/gif
Size: 19289 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-Talkers-0001.gif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Top-TCP-Talkers.gif
Type: image/gif
Size: 18003 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-TCP-Talkers-0001.gif
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Top-UDP-Talkers.gif
Type: image/gif
Size: 18858 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060619/92a94dd7/Top-UDP-Talkers-0001.gif
Powered by blists - more mailing lists