[logs] Re: Looking to graphically map ip conversations

Previous message: todd glassey: "[logs] Re: Looking to graphically map ip conversations"
In reply to: Seth Leone: "[logs] Looking to graphically map ip conversations"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

jess@private

Hi Seth,

I don't know what kind of graphing you want to do, but etherape
graphically displays the traffic exchanged between hosts using different
colors for different protocols as well as the amount of traffic being
exchanged at each moment. It can take its input from a pcap file
(assuming that "dead log files" means pcap file captures):

http://etherape.sourceforge.net

Additionally, there was a talk in the last Black Hat conference by  Greg
Conti, "Beyond Ethereal: Crafting A Tivo for Security Datastreams",
where he presented rumint, a graphical tool for analyzing traffic
(although I don't know if this one goes in the direction of what you are
looking for):

http://www.rumint.org/software.html

I haven't had the time to play with it yet though.

JESS

-----------------------
http://www.jessland.net
-----------------------

Seth Leone wrote:
> Hi,
> 
> I am looking for any pointers to open source or
> commercial software that can graphically map ip
> conversations via "dead" log files [not live
> traffic!]. 
> 
> Products I already know of: visio(more manual than i
> would like *grin*), silentrunner(aka now net
> Forensics, i think) and the netboy suite(not
> available).
> 
> Thanks,
> 
> 
> 
> 
> 
> 		
> ____________________________________________________
> Start your day with Yahoo! - make it your home page 
> http://www.yahoo.com/r/hs 
>  
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis@private
> http://lists.shmoo.com/mailman/listinfo/loganalysis

_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis