|
A freeware tool to trace TCP/UDP/... sessions and fetch application data from snoop or tcpdump logs. This is a type of 'any-snarf' program, as it will fetch telnet sessions, FTP files, HTTP transfers (HTML, GIF, JPEG, ...), SMTP emails, ... from the captured data inside network traffic logs. A html index file is created that links to all the session details, including realtime replay programs for telnet, rlogin, IRC, X11 and VNC sessions; and reports such as image reports and HTTP GET/POST content reports. Chaosreader can also run in standalone mode - where it invokes tcpdump or snoop (if they are available) to create the log files and then processes them.Feature List - Reads Solaris snoop logs and four versions of tcpdump/libpcap logs
- Standalone mode generates a series of logs and then processes those
- Processes HTTP, FTP, telnet, SMTP, IRC, ... application protocols
- Processes any TCP and UDP traffic
- Processes 802.11b wireless traffic
- Processes PPPoE traffic, tun device traffic
- Retrieves transferred files from FTP and HTTP traffic
- Creates HTML and text reports to list contents of the log
- Creates realtime replay programs for telnet or IRC sessions
- Creates red/blue coloured HTML reports for 2-way sessions such as telnet and FTP
- Creates red/blue coloured HTML reports for any TCP, UDP or ICMP traffic
- Creates image reports from HTTP, FTP transfers
- Creates HTTP GET and POST reports from queries
- Creates red/blue coloured HTML hex dumps for any TCP, UDP or ICMP traffic
- Creates plain text hex dumps for any TCP, UDP or ICMP traffic
- Creates HTTP proxy logs based on observed HTTP traffic, using the squid log format
- Creates X11 realtime replay programs to playback an X11 session. (experimental).
- Creates red/blue coloured HTML reports for X11 text and keystrokes.
- Creates realtime replay programs for X11 text communication.
- Creates VNC realtime replay programs to playback a VNC session. (experimental).
- Creates HTML reports for VNC keystrokes.
- Creates realtime replay programs for VNC keystrokes.
- SSH content analysis. reports, replays and keystroke delay data files.
- Creates raw data files from TCP or UDP transfers
- Supports TCP out of sequence number delivery
- Supports IP fragmentation
- Supports IPv4 and IPv6
- Processes ICMP and ICMPv6
- Very configurable (including filtering on IPs and ports)
- Can sort data based on time, size, type or IP.
- Can skip sessions smaller than a min size.
- Runs on Solaris, RedHat, Windows, ...
|
