3

I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons.

I want to know if it is possible to feed traffic analysis into some kind of engine to parse out a whitelist of applications and ports. E.G. load a few day's worth of pcapng files and get back a list of "IP.src, IP.dst, Port, Application name". Are there any tools for that kind of profiling?

1
  • 4
    wireshark does exactly this
    – schroeder
    Aug 25, 2015 at 15:49

2 Answers 2

3

You can use Wireshark to extract conversation statistics from the packet captures. This information can then be sorted through to determine which ports are used regularly:

Wireshark Conversation Statistics

This screen is from the Wireshark Statistics->Conversations menu items. It also has a "Copy" button which will allow you to get this data as CSV; you could then extract destination ports simply:

gawk -F, '{print $4}' convo.csv | sort | uniq -c

or do more complex analysis based on source and destination. Personally, if I were doing it, I'd load the CSV into a sqlite database for ease of querying seven ways from Sunday.

You can also automate the extraction of the conversation statistics by using tshark to cut your workload - less clicky clicky, more worky worky.

0

I don't know if i understand your question well enough, but to me this sounds like all you really want is to open the pcapng-file(s) in Wireshark.

Maybe my answer is totally off the track. If this is the case, please specify your question further.

3
  • 1
    That would work, but my problem is combing through days of data manually. I was hoping to get a summary output rather than burn my time noting each unique flow. It's a large and unnecessarily complex business unit, so I'm hoping to cut workload where possible.
    – Alex Cosby
    Aug 25, 2015 at 15:57
  • @AlexCosby Wireshark provides summaries.
    – schroeder
    Aug 25, 2015 at 16:03
  • hmmm. i don't have much time investigating that right now, but there are a bunch of tools shipping with wireshark. Maybe have a look here - i doubt that wireshark doesn't supply the methods you need natively! wiki.wireshark.org/Tools the hard way would be offcourse to write a parsing/extracting script yourself, if this is an option.
    – Gewure
    Aug 25, 2015 at 16:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .