I'm investigating options for segmenting a less secure business unit behind a Cisco 5505. I want to take this action quietly and transparently for political reasons.

I want to know if it is possible to feed traffic analysis into some kind of engine to parse out a whitelist of applications and ports. E.G. load a few day's worth of pcapng files and get back a list of "IP.src, IP.dst, Port, Application name". Are there any tools for that kind of profiling?

  • 4
    wireshark does exactly this – schroeder Aug 25 '15 at 15:49

You can use Wireshark to extract conversation statistics from the packet captures. This information can then be sorted through to determine which ports are used regularly:

Wireshark Conversation Statistics

This screen is from the Wireshark Statistics->Conversations menu items. It also has a "Copy" button which will allow you to get this data as CSV; you could then extract destination ports simply:

gawk -F, '{print $4}' convo.csv | sort | uniq -c

or do more complex analysis based on source and destination. Personally, if I were doing it, I'd load the CSV into a sqlite database for ease of querying seven ways from Sunday.

You can also automate the extraction of the conversation statistics by using tshark to cut your workload - less clicky clicky, more worky worky.

|improve this answer|||||

I don't know if i understand your question well enough, but to me this sounds like all you really want is to open the pcapng-file(s) in Wireshark.

Maybe my answer is totally off the track. If this is the case, please specify your question further.

|improve this answer|||||
  • 1
    That would work, but my problem is combing through days of data manually. I was hoping to get a summary output rather than burn my time noting each unique flow. It's a large and unnecessarily complex business unit, so I'm hoping to cut workload where possible. – Alex Cosby Aug 25 '15 at 15:57
  • @AlexCosby Wireshark provides summaries. – schroeder Aug 25 '15 at 16:03
  • hmmm. i don't have much time investigating that right now, but there are a bunch of tools shipping with wireshark. Maybe have a look here - i doubt that wireshark doesn't supply the methods you need natively! wiki.wireshark.org/Tools the hard way would be offcourse to write a parsing/extracting script yourself, if this is an option. – Gewure Aug 25 '15 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.