Honeypots: Re: pcap log analysis

["Elliott C. Bäck" <ecb29 () cornell edu>]

Did you check out capinfo?  It only displays a few simple stats, but 
it's something:
Capinfo is a tool for displaying statistics about network traffic from 
files saved with tcpdump or snoop:
http://tcpreplay.sourceforge.net

Augur might do something useful, although I can't tell and I've never 
used it:
http://augur.sourceforge.net/

And etherscope will display graphs about interface bandwidth matching 
certain filters:
http://etherscope.sourceforge.net/

Of course, you can open those files in ethereal to display a lot of 
"raw" and "analysed" information,  but I don't think it will do much in 
the way of graphs, charts, or statistics.
--
Elliott Bäck
http://www.people.cornell.edu/pages/ecb29
<http://tcpreplay.sourceforge.net/capinfo.txt>
Joe Hickory wrote:

> hi list, 
>
> anybody knows or has some shell scripts or the like with which i can analyse
> network 
> traffic saved in pcap format in a file. didn't wanted to reinvent the wheel,
> as i think there are others who faced the same problem before, but couldn't
> find 
> anything. 
>
> some nice created diagrams out of the data would be great, but not
> neccessary. 
>
> any suggestion would be great 
>
> joe 
>
>