b0VIM 6.46rgDMEJrootrmarty/home/ram/afterglow/src/perl/parsers/tcpdump2csv.plU3210#"! Utp?0@Woad"2?~7F R   t r " o m Z  x v J E    u -  BA0/32ML54" ]1'fdOM$}|gfQ=%  $ipflags =~ s/\[(.*)\]/\1/g; # getting rid of square brackets $ipflags = $fields[15]; $offset = $fields[14]; $id = $fields[13]; $ttl = $fields[12]; $tos = $fields[11]; $len =~ s/:$//; $len = $fields[9]; $destmac =~ s/,//g; $destmac = $fields[4]; $fields[4] =~ s/,$//; $sourcemac = $fields[2]; $timestamp =~ s/(.*?)\.\d+$/\1/; $timestamp = $fields[0]." ".$fields[1]; # some sanitization next if ($fields[6] eq "ARP"); # skip ARP next if ($fields[5] eq "802.3,"); # skip 802.3 packets: my @fields = split (" ",$input); } next; $DEBUG && print STDERR "ERROR: $input\n"; } else { $input = "$1 $2 $3 $4 $5 $6$7 $8 $9 $10"; if ($input =~ /(.*) \(tos (\S+), ttl +(\d+), id (\d+), offset (\d+), flags ([\S\+]+)(?:, proto \d+)?(?:, ([\S\+]+))?, length: (\d+)(?:, .*?)?\) (.*)/) { my $input = $_; $flags = undef; chomp;while () 2006-05-14 11:06:03.674577 00:01:4e:00:b6:59 > 00:05:4e:44:b7:25, ethertype IPv4 (0x0800), length 82: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto: UDP (17), length: 68) 10.69.69.20.33038 > 10.69.69.13.615: UDP, length 40# 2002-08-24 10:52:42.184488 00:03:e3:d9:26:c0 > 00:00:0c:04:b2:33, ethertype IPv4 (0x0800), length 60: IP (tos 0x0, ttl 232, id 0, offset 8896, flags [+, DF], length: 40, bad cksum ff99 (->b4d9)!) 192.9.100.88 > 138.97.10.219: tcp# 2002-08-24 05:34:18.634488 00:00:0c:04:b2:33 > 00:03:e3:d9:26:c0, ethertype IPv4 (0x0800), length 223: IP (tos 0x0, ttl 122, id 544, offset 0, flags [DF], length: 209, bad cksum ff6b (->14ac)!) 138.97.18.88.61924 > 64.4.12.158.1863: P [bad tcp cksum 6c66 (->aca6)!] 9384:9553(169) ack 9641 win 17390use strict vars;###############################################################################/## Also introducing the $DEBUG variable# 12/17/05 Fixing error handling. Should not exit when an unknown packet arrives# port < 1024 is the server# If no SYN or SYN ACK seen for a connection, assume the machine with# Server: receives a SYN or sends a SYN ACK# 06/25/05 ram's birthday: taking care of source and target swapping # 06/13/05 Initial Version by ram# # Changes: ## URL: http://afterglow.sourceforge.net# # ATTENTION: ONLY works with tcpdump 3.8.x## Does not parse multi-line DNS packets# Does not parse SAP packets# Does not parse ARP packets# Known Issues:## sourcemac destmac ipflags sport dport# timestamp dip sip ttl tos id offset flags len # Possible fields:## perl ../graph/afterglow.pl | neato -Tgif -o test.gif# tcpdump -vttttnnelr /tmp/log.tcpdump | ./tcpdump2csv.pl "sip dip sport" | # Running in conjunction with afterglow:## Usage: tcpdump -vttttnnelr /tmp/log.tcpdump | ./tcpdump2csv.pl ["field list"]## Description: Takes a tcpdump pcap file and parses it into a csv output.## Version: 1.1## File: tcpdump2csv.pl## Title: TCPdump 2 CSV## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA# along with this program; if not, write to the Free Software# You should have received a copy of the GNU General Public License# # GNU General Public License for more details.# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the# but WITHOUT ANY WARRANTY; without even the implied warranty of# This program is distributed in the hope that it will be useful,# # (at your option) any later version.# the Free Software Foundation; either version 2 of the License, or# it under the terms of the GNU General Public License as published by# This program is free software; you can redistribute it and/or modify# # Copyright (c) 2006 by Raffael Marty##!/usr/bin/perlad I  L K J I H # 2005-09-08 16:38:05.696393 00:03:93:ea:dc:2f > 33:33:00:00:00:fb, ethertype IPv6 (0x86dd), length 349: fe80::203:93ff:feea:dc2f.5353 > ff02::fb.5353: [udp sum ok] 0*- [0q] 8/0/0 _services._dns-sd._udp.local. PTR _ftp._tcp.local., _services._dns-sd._udp.local. PTR _workstation._tcp.local., _services._dns-sd._udp.local. PTR _ssh._tcp.local., _services._dns-sd._udp.local. PTR _sftp-ssh._tcp.local., _services._dns-sd._udp.local. PTR _http._tcp.local., _services._dns-sd._udp.local. PTR _daap._tcp.local., _services._dns-sd._udp.local. PTR _dacp._tcp.local., F.2.C.D.A.E.E.F.F.F.3.9.3.0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.E.F.ip6.arpa. (Cache flush) PTR Altair.local. (287) (len 295, hlim 255)# 2005-09-08 16:38:05.896611 00:03:93:ea:dc:2f > 33:33:00:00:00:fb, ethertype IPv6 (0x86dd), length 459: fe80::203:93ff:feea:dc2f.5353 > ff02::fb.5353: [udp sum ok] 0 [8q] [8n] ANY? Altair._ftp._tcp.local. ANY? Altair [00:03:93:d5:81:02]._workstation._tcp.local. ANY? Altair._ssh._tcp.local. ANY? Altair._sftp-ssh._tcp.local. ANY? Ari Serim._http._tcp.local. ANY? AriM-bM-^@M-^Ys Beats._daap._tcp.local. ANY? iTunes_Ctrl_AE2BB3BEAAAB7A8B._dacp._tcp.local. ANY? Altair.local. (397) (len 405, hlim 255)# 2005-09-08 16:38:08.146159 00:03:93:ea:dc:2f > 33:33:00:00:00:02, ethertype IPv6 (0x86dd), length 86: fe80::203:93ff:feea:dc2f > ff02::2: HBH (padn)(rtalert: 0x0000) [icmp6 sum ok] icmp6: multicast listener done max resp delay: 0 addr: ff02::fb [hlim 1] (len 32)adsWWH4m^J-,  Z Y 2   j P   [ Z @  d c  v D & f\:}xtfca_]\N(?Tsr# 2005-09-08 16:38:11.013187 00:03:93:ea:dc:2f > 33:33:ff:ea:dc:2f, ethertype IPv6 (0x86dd), length 86: fe80::203:93ff:feea:dc2f > ff02::1:ffea:dc2f: HBH (padn)(rtalert: 0x0000) [icmp6 sum ok] icmp6: multicast listener report max resp delay: 0 addr: ff02::1:ffea:dc2f [hlim 1] (len 32)# 2005-09-08 16:38:14.906293 00:14:69:1f:b3:00 > 01:00:0c:cc:cc:cc, 802.3, length 338: LLC, dsap SNAP (0xaa), ssap SNAP (0xaa), cmd 0x03, CDPv2, ttl: 180s, checksum: 692 (unverified), length 316# 2005-05-03 18:42:31.274438 00:0d:56:74:c4:d9 > ff:ff:ff:ff:ff:ff, 802.3, length 94: LLC, dsap Global (0xff), ssap Global (0xff), cmd 0x00, (NOV-802.3) 00000000.00:0d:56:74:c4:d9.0455 > 00000000.ff:ff:ff:ff:ff:ff.0455: ipx-netbios 50# 2005-01-12 14:38:20.660616 00:0d:56:e3:44:33 > 33:33:00:00:00:02, ethertype IPv6 (0x86dd), length 70: fe80::20d:56ff:fee3:4433 > ff02::2: [icmp6 sum ok] icmp6: router solicitation (src lladdr: 00:0d:56:e3:44:33) (len 16, hlim 255)# 2005-09-08 16:38:27.397885 00:12:f0:c9:59:0e > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp reply 10.0.0.183 is-at 00:12:f0:c9:59:0e# 2005-01-12 14:36:48.911346 00:0d:56:fc:f3:04 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: arp who-has 192.168.2.13 tell 192.168.2.12# To be done:} } print "\n"; } } print ','.$$token; } else { #exit; $DEBUG && print STDERR "$token is not a known field\n"; if (!defined($$token)) { for my $token (@tokens) { print ${shift(@tokens)}; my @tokens = split / /,$output; } else { print "$timestamp $sourcemac $destmac $sip $dip $sport $dport $flags $len $proto $ttl $id $offset $tos $ipflags\n"; if ($output eq "full") { } } ($sport,$dport) = ($dport,$sport); ($sip,$dip) = ($dip,$sip); ($sourcemac,$destmac) = ($destmac,$sourcemac); # swap source and dest: $clientServerConn{$reverseConnId}="1"; if (($sport < 1024) && ($dport > 1024)) { # This is better than not doing it :) # we never saw a SYN or a SYN ACK and we are in TCP, let us try the port numbers } elsif ((!$clientServerConn{$reverseConnId}) && (!$clientServerConn{$connId}) && ($proto eq "tcp")) { ($sport,$dport) = ($dport,$sport); ($sip,$dip) = ($dip,$sip); ($sourcemac,$destmac) = ($destmac,$sourcemac); # swap source and dest: } elsif ($clientServerConn{$reverseConnId}) { $clientServerConn{$connId}="1"; } elsif ($flags =~ /S/) { # client to server ($sport,$dport) = ($dport,$sport); ($sip,$dip) = ($dip,$sip); ($sourcemac,$destmac) = ($destmac,$sourcemac); # swap source and dest: $clientServerConn{$reverseConnId}="1"; if ($flags =~ /S.*A/) { # server to client # trying to find the client and the server and the act opon that my $reverseConnId = $dip.$sip.$dport.$sport; my $connId = $sip.$dip.$sport.$dport; if ($input =~ / ack /) { $flags .= "A"; } # adding ACK flag as an "A" $proto = "tcp" if ($fields[20] =~ /[SRPU.]+/); $flags = $fields[20] if ($fields[20] =~ /[SRPU.]+/); my $proto = "null"; #$fields[20]; } else { $dport = "null"; } $dport =~ s/:$//; $dport = $1; if ($dport =~ /[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.(.*)/) { $dport = $fields[19]; $dip = $fields[19]; $dip =~ s/([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+).*/\1/; $dip =~ s/:$//; } else { $sport = "null"; } $sport =~ s/:$//; $sport = $1; if ($sport =~ /[^\.]+\.[^\.]+\.[^\.]+\.[^\.]+\.(.*)/) { $sport = $fields[17]; $sip = $fields[17]; $sip =~ s/([^\.]+\.[^\.]+\.[^\.]+\.[^\.]+).*/\1/; $sip =~ s/:$//;ad 0ihQP>6%vJ@    } h f =    j V > % $ipflags =~ s/\[(.*)\]/\1/g; # getting rid of square brackets $ipflags = $fields[15]; $offset = $fields[14]; $id = $fields[13]; $ttl = $fields[12]; $tos = $fields[11]; $len =~ s/:$//; $len = $fields[9]; $destmac =~ s/,//g; $destmac = $fields[4]; $fields[4] =~ s/,$//; $sourcemac = $fields[2]; $timestamp =~ s/(.*?)\.\d+$/\1/; $timestamp = $fields[0]." ".$fields[1]; # some sanitization next if ($fields[6] eq "ARP"); # skip ARP next if ($fields[5] eq "802.3,"); # skip 802.3 packets: my @fields = split (" ",$input); } next; $DEBUG && print STDERR "ERROR: $input\n"; } else { $input = "$1 $2 $3 $4 $5 $6$7 $8 $9 $10"; if ($input =~ /(.*) \(tos (\S+), ttl +(\d+), id (\d+), offset (\d+), flags ([\S\+]+)(?:, proto (?:\d+)?(?:, ([\S\+]+))?, length: (\d+)(?:, .*?)?\) (.*)/) { my $input = $_; $flags = undef; chomp;while () {our %clientServerConn;our ($timestamp,$dip,$sip,$ttl,$tos,$id,$offset,$flags,$len,$sourcemac,$destmac,$ipflags,$sport,$dport);my $DEBUG=0;my $output=$ARGV[0] || "full";