[logs] Re: Looking to graphically map ip conversations

From: Jess Garcia (jess@private)
Date: Thu Aug 04 2005 - 17:19:34 PDT

Hi Seth,

I don't know what kind of graphing you want to do, but etherape
graphically displays the traffic exchanged between hosts using different
colors for different protocols as well as the amount of traffic being
exchanged at each moment. It can take its input from a pcap file
(assuming that "dead log files" means pcap file captures):


Additionally, there was a talk in the last Black Hat conference by  Greg
Conti, "Beyond Ethereal: Crafting A Tivo for Security Datastreams",
where he presented rumint, a graphical tool for analyzing traffic
(although I don't know if this one goes in the direction of what you are
looking for):


I haven't had the time to play with it yet though.



Seth Leone wrote:
> Hi,
> I am looking for any pointers to open source or
> commercial software that can graphically map ip
> conversations via "dead" log files [not live
> traffic!]. 
> Products I already know of: visio(more manual than i
> would like *grin*), silentrunner(aka now net
> Forensics, i think) and the netboy suite(not
> available).
> Thanks,
> ____________________________________________________
> Start your day with Yahoo! - make it your home page 
> http://www.yahoo.com/r/hs 
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis@private
> http://lists.shmoo.com/mailman/listinfo/loganalysis

LogAnalysis mailing list

This archive was generated by hypermail 2.1.3 : Thu Aug 04 2005 - 18:29:56 PDT