Re: [logs] analyzing tcpdump logs

Previous message: zidanat_private: "[logs] analyzing tcpdump logs"
In reply to: zidanat_private: "[logs] analyzing tcpdump logs"
Next in thread: Devdas Bhagat: "Re: [logs] analyzing tcpdump logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

joseat_private

On Thu, 14 Aug 2003 zidanat_private wrote:

> I can open it in ethereal and use filters to check certain thigs, but I
> would like to check top-talkers, application flows... things like that.

start with some of the following tools:

	- aguri
	  will help you identify the top talkers, ports, etc ...
	- argus
	  will help you get a flow based approach to this
	- softflowd
	  can convert to netflow v1 for you
	- tcpflow
	  can help reconstruct streams/flows
	- ntop
	  can help you identify top talkers

these are just a few of the tools i use to slice through my pcap data.

___________________________
jose nazario, ph.d.			joseat_private
					http://monkey.org/~jose/
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis