things to assist in packet analysis
HTML Shell Python
Switch branches/tags
Nothing to show
Clone or download
Latest commit 598dd15 Jun 4, 2018
Permalink
Failed to load latest commit information.
.gitignore updated gitignore to inclide *pacp[0-9] and foo Feb 19, 2017
README.md adding ping-time Jun 4, 2018
analyze-arps.sh adding analyze-arps script and information page Apr 19, 2018
analyze-arps.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
average.sh Added copyright and GNU GPL statement and disclaimer Apr 2, 2017
average.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
bluebar.gif Corrected some bugs in split-pcap.py. Added HTML documentation for av… Jul 10, 2017
build-filter.sh Adding build-filter.sh and build-filter.sh.html Oct 22, 2017
build-filter.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
bytes-in-flight.sh Added bytes-in-flight.sh.html and corrected some typos in bytes-in-fl… Jul 11, 2017
bytes-in-flight.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
concret.jpg Corrected some bugs in split-pcap.py. Added HTML documentation for av… Jul 10, 2017
dns-time.sh added the server response code to the output table so you can tell th… Feb 13, 2018
dns-time.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
failed-connection-attempts.sh fixed failed failure to recognize RST connections and added SaR scenario Apr 8, 2018
failed-connection-attempts.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
find-ips.sh adding find-ip.sh and find-ips.sh.html Sep 7, 2017
find-ips.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
find-mangled-sequence-numbers.sh adding find-mangled-sequence-numbers Apr 25, 2018
find-mangled-sequence-numbers.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
find-reset-connections.sh print only the segment with the first reset and removed need for the … Apr 30, 2017
find-reset-connections.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
find-retran-failures.sh Adding find-retran-failures Mar 20, 2018
find-retran-failures.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
fix-pcap.sh adding fix-pcap.sh Sep 7, 2017
fix-pcap.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
local-drops.sh added the pattern string to the output and corrected some typos in th… Jun 29, 2017
local-drops.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
mailbox.gif Corrected some bugs in split-pcap.py. Added HTML documentation for av… Jul 10, 2017
packet-matcher-faster.sh fixed packet-matcher-faster.sh to handle duplicates and report when t… Sep 17, 2017
packet-matcher-faster.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
packet-matcher.sh added check for too many repeating characters, added template string … Mar 8, 2018
packet-matcher.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
percent-retransmissions.sh adding percent-retransmissions.sh Jun 3, 2017
percent-retransmissions.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
ping-message.sh adding ping-message.sh and html Jun 4, 2018
ping-message.sh.html adding ping-message.sh and html Jun 4, 2018
ping-time.sh adding ping-time Jun 4, 2018
ping-time.sh.html adding ping-time Jun 4, 2018
split-pcap.py Corrected split-pcap.py to handle both Ethernet and Cooked Linux traces Jul 14, 2017
split-pcap.py.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
start-packet-tracing.sh Added copyright and GNU GPL statement and disclaimer Apr 2, 2017
start-packet-tracing.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
stream_throughput.sh Removed the TSHARK-FILTER argument from stream-throughpt, added a che… Jul 27, 2017
stream_throughput.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
throughput-per-sec.sh added throughput-per-second.sh and html Oct 22, 2017
throughput-per-sec.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
throughput-per-second-a.png added throughput-per-second.sh and html Oct 22, 2017
throughput-per-second-b.png added throughput-per-second.sh and html Oct 22, 2017
throughput-per-second-c.png added throughput-per-second.sh and html Oct 22, 2017
throughput-per-second-d.png added throughput-per-second.sh and html Oct 22, 2017
throughput-per-second-e.png added throughput-per-second.sh and html Oct 22, 2017
time-summary.sh will now skip trace files with no packets and hense a start time of n/a Feb 14, 2018
time-summary.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018
unterminated-connections.sh Added copyright and GNU GPL statement and disclaimer Apr 2, 2017
unterminated-connections.sh.html updated all html pages with a link back to the actual script. also ma… Apr 26, 2018

README.md

analyze-arps.sh

Analyze the ARP packets in a trace file. Calculates the ARP response time and idenifies ARP requests with no replies, gratuitous ARPs, duplicate IPs and duplicate MACs. See analyze-arps.sh.html.

average.sh

Average a value returned by tshark. See average.sh.html.

build-filter.sh

Builds a tshark filter by ANDing or ORing the values in a list with a tshark variable. See build-filter.sh.html.

bytes-in-flight.sh

Calcuate the bytes in flight after each ACK. See bytes-in-flight.sh.html.

dns-time.sh

Create a table of DNS server query response times and list of unanswered queries. See bytes-in-flight.sh.html.

failed-connection-attempts.sh

Find TCP connection attempts that have a failed. There are 6 failure scenarios, See failed-connection-attempts.sh.html.

find-ips.sh

Uses egrep to list all strings in a file that match an IPv4 address format and the sort -u to get a unique list. Really just a one-liner by this way I do not have to remember (or type) the egrep string. Its useful with build-filter.sh to create a filter to display all the IPs listed in say a log file. See find-ips.sh.html.

find-mangled-sequence-numbers.sh

Analyze a packet trace for packets where the sequence number in the ACK field does not match the sequence numbers in the selective acknowledgement blocks. See find-mangled-sequence-numbers.sh.html.

find-reset-connections.sh

Find TCP connections that have been reset without being closed. See find-reset-connections.sh.html.

find-retran-failures.sh

Find TCP connections that appear to have failed because of retransmission failures. See find-retran-failures.sh.html.

fix-pcap.sh

Removes a partial packet at the end of a packet trace file. See fix-pcap.sh.html.

local-drops.sh

For each retransmitted TCP segment determine if the segment is seen more than once. See local-drops.sh.html.

packet-matcher-faster.sh

Compares IP ID and absolute TCP sequence and ACK numbers between two traces to match up TCP segments where the IP addresses and or TCP have been changed (i.e. NAT). See packet-matcher-faster.sh.html.

packet-matcher.sh

Extracts byte strings from a TCP stream in a template trace and looks for the strings in a target trace. The goal is to find a match TCP stream in the target trace file. See packet-matcher.sh.html.

percent-retransmissions.sh

For every connection in the trace file calculate the percentage of retransmissions for every source IP address as retransmissions / not-retransmitted source segments. segments must contain data, i.e.will not identify retransmitted SYNs or FINs without data. See percent-retransmissions.sh.html.

ping-time.sh

Send an ICMP echo request (ping) with a 16 character time stamp (HH:MM:SS.sssssssss) embedded in it instead of the standard sequence of ascii characaters. See ping-time.sh.html.

ping-message.sh

Send an ICMP echo request (ping) with a 16 character message embedded in it instead of the standard sequence of ascii characaters. See ping-message.sh.html.

split-pcap.py

Reads X.pcap and creates a set of X.pcap_IP1-Port1_IP2-Port2_split.pcap files, one for each TCP four-tuple. Reads only pcap files not pcapng. Requires Python and the scapy module. See split-pcap.py.html.

start-packet-tracing.sh

Runs tcpdump in the background with 10 files of 100 Meg each. See start-packet-tracing.sh.html.

stream-throughput.sh

Calculate the throughput of all TCP streams in a trace file. See stream-throughput.sh.html.

throughput-per-sec.sh

Calculate throughput per second of a specific stream at resolutions of 1, 1/10, 1/100, and 1/1000 of a second. results are suitable for graphing. See throughput-per-sec.sh.html.

time-summary.sh

Finds all files in the current directory and any sub directories and displays then start and end times in sorted order. See time-summary.sh.html.

unterminated-connections.sh

Find TCP connections that have not been closed or reset. See unterminated-connections.sh.html.