|Version 7 (modified by perry, 7 years ago) (diff)|
The various tools can do some neat things that you might not realise. Heres a list of cool things they can do.
Capture a trace file
traceconvert int:eth0 pcapfile:foo.pcap.gz
(substitute pcapinf: for int: if your not on Linux.
To capture with a filter:
tracefilter int:eth0 'port 80' pcapfile:foo.pcap.gz
This isn't smart enough to do snapping, anonymisation, file rotation or anything an advanced capture suite would do. If you need more advanced capturing software use wdcap. (It also doesn't flush things to disk as often as it should).
To replay a trace
Warning, this will replay the trace exactly as it was captured -- including IP headers, link level headers, etc.
traceconvert pcapfile:foo.pcap.gz int:eth0
Investigate whats in a trace
To merge two directions back into one file
tracemerge -i pcapfile:foo-combined.gz pcapfile:foo-in.pcap.gz pcapfile:foo-out.gz
To concatenate traces together
tracemerge -s erf:out.gz erf:in-*.gz
Things all tools can do
All tools can read off a network with int:/bpf:/pcapint:/dag:, or from stdin with pcapfile:-/pcap:-/erf:-/legacypos:-/legacyatm:-/legacyeth:-.
All tools can write to a network with int:/pcapint:, or to standard out with pcapfile:-/pcap:-
Speed up trace processing on a dual processor machine
On a dual processor machine you can do decompression on one CPU and the trace processing on another. Having a buffer in between the two will decouple them and get even more cpu usage out of them. At WAND we use the command line:
zcat tracefile.erf.gz | bfr | ./tool erf:-
Doing decompression in a seperate thread is likely to be added to some later release of libtrace.
1:1 NAT from one IP range to another
This will map 10.1.0.0/16 on eth0 to 192.168.0.0/16 on eth1.
tracefilter int:eth0 'src 10.1.0.0/16' pcapfile:- | traceanon -s -p 192.168.0.0/16 pcapfile:- int:eth1 tracefilter int:eth1 'dst 192.168.0.0/16' pcapfile:- | traceanon -d -p 10.1.0.0/16 pcapfile:- int:eth0
Get some stats about a interface/trace
substitute int:eth0 for pcapfile:trace.gz to produce stats on a trace.
Get more detailed stats on a trace
tracesummary pcapfile:foo.pcap.gz tracereport pcapfile:foo.pcap.gz tracertstats pcapfile:foo.pcap.gz
Note that tracereport/tracesummary waits for its input to complete, since an interface never completes it won't ever finish tallying results.