TCP flow extraction

Question

Hello My Friends, I need to extract TCP Flows with their content from dump file and then save their flow into other file each flow separately, does any one know a tool for processing this?

I really appreciate for any Help

Hanieh Rajabi.

Answer 1

Wire shark maybe? It can be used to filter sessions and I think you can then save them seperatly.

Answer 2

If you're only doing a few, Wireshark can do this.

Steps:

1. Open up the capture in Wireshark.
2. Click on a packet from the TCP connection you're interested in
3. Analyze -> Follow TCP Stream
4. Click 'Raw'
5. Select (from the popup menu) one of 'Entire Conversation' or one of the two directions.
6. Click 'Save As'

Alternate steps, for HTTP only:

1. Open up the capture
2. Select File -> Export -> Objects -> HTTP
3. A dialog will open showing all the HTTP objects in the capture. You can save some or all of them.

This is with Wireshark 1.2.1 on Linux/GTK. The 'follow TCP stream' option has been moved around between versions, so it may be somewhere else if you have an older version. But its always been called Follow TCP Stream so you should be able to find it.

Quick searching also reveals several other options if Wireshark doesn't work for you: ngrep, tcpick, chaosreader, and tcpflow.

Answer 3

You could also have a look at NetFlow and related tools.

Answer 4

Thanks All Dear, since I am processing so many dump files,I need a tool to do saving automatically not manually way and, The problem of using tcpick and tcpflow is I am not sure whether they can open the dump file or they can just do sniffing themself and then save the dump file.

I'm really appreciated with Regards, Hanieh