# Tool which does network analysis similar to VRTA

There is a tool called Visual RoundTrip Analyzer (VRTA) on MS-Windows where all SYN and SYN-ACK and other components of a web-page are known alongwith the time they take. I know that most of the web-browsers have a similar tool to check performance while on the web. Is there an independant tool in GNU/Linux to know the same? I am on Debian and would like to have something which has output in the form of SYNK and ACK

As can be seen I am looking for something similar in a stand-alone utility by itself.

• Welcome to the Android Enthusiasts! We will need much more information to give good recommendations here – asking for "a tool like X" is never giving enough details, even if linked. You should always list your requirements explicitly. Please see How to ask for an alternative to some software and the questions linked to it for details – then edit your post and see if you can improve it. You'll get much better answers that way. Thanks! – Izzy Dec 11 '14 at 15:51

You could monitor the network traffic with Scapy it can capture and analyse all of the web traffic, (and do a lot more), to allow you to visualise the times for each request and reply. You can even originate the various requests from within scapy so as to remove any browser dependence. Some examples of this sort of thing can be seen on the demo page. e.g. (lifted example): Classic SYN Scan can be initialized by executing the following command from Scapy’s prompt:

>>> sr1(IP(dst="72.14.207.99")/TCP(dport=80,flags="S"))


The above will send a single SYN packet to Google’s port 80 and will quit after receving a single response:

Begin emission: .Finished to send 1 packets.
* Received 2 packets, got 1 answers, remaining 0 packets <IP  version=4L ihl=5L tos=0x20 len=44 id=33529 flags= frag=0L ttl=244 proto=TCP chksum=0x6a34 src=72.14.207.99 dst=192.168.1.100 options=// | <TCP  sport=www dport=ftp-data seq=2487238601L ack=1 dataofs=6L reserved=0L flags=SA window=8190 chksum=0xcdc7 urgptr=0 options=[('MSS', 536)] | <Padding  load='V\xf7' |>>>


From the above output, we can see Google returned “SA” or SYN-ACK flags indicating an open port.

Use either notations to scan ports 400 through 443 on the system:

>>> sr(IP(dst="192.168.1.1")/TCP(sport=666,dport=(440,443),flags="S"))


or

>>> sr(IP(dst="192.168.1.1")/TCP(sport=RandShort(),dport=[440,441,442,443],flags="S"))


In order to quickly review responses simply request a summary of collected packets:

>>> ans,unans = _
>>> ans.summary()
IP / TCP 192.168.1.100:ftp-data > 192.168.1.1:440 S ======> IP / TCP 192.168.1.1:440 > 192.168.1.100:ftp-data RA / Padding
IP / TCP 192.168.1.100:ftp-data > 192.168.1.1:441 S ======> IP / TCP 192.168.1.1:441 > 192.168.1.100:ftp-data RA / Padding
IP / TCP 192.168.1.100:ftp-data > 192.168.1.1:442 S ======> IP / TCP 192.168.1.1:442 > 192.168.1.100:ftp-data RA / Padding
IP / TCP 192.168.1.100:ftp-data > 192.168.1.1:https S ======> IP / TCP 192.168.1.1:https > 192.168.1.100:ftp-data SA / Padding


The above will display stimulus/response pairs for answered probes. We can display only the information we are interested in by using a simple loop:

>>> ans.summary( lambda(s,r): r.sprintf("%TCP.sport% \t %TCP.flags%") )
440      RA
441      RA
442      RA
https    SA


Even better, a table can be built using the make_table() function to display information about multiple targets:

>>> ans,unans = sr(IP(dst=["192.168.1.1","yahoo.com","slashdot.org"])/TCP(dport=[22,80,443],flags="S"))
Begin emission:
.......*.**.......Finished to send 9 packets.
**.*.*..*..................
>>> ans.make_table(
...    lambda(s,r): (s.dst, s.dport,
...    r.sprintf("{TCP:%TCP.flags%}{ICMP:%IP.src% - %ICMP.type%}")))
66.35.250.150                192.168.1.1 216.109.112.135
22  66.35.250.150 - dest-unreach RA          -
80  SA                           RA          SA
443 SA                           SA          SA


The above example will even print the ICMP error type if the ICMP packet was received as a response instead of expected TCP.

For larger scans, we could be interested in displaying only certain responses. The example below will only display packets with the “SA” flag set:

>>> ans.nsummary(lfilter = lambda (s,r): r.sprintf("%TCP.flags%") == "SA")
0003 IP / TCP 192.168.1.100:ftp_data > 192.168.1.1:https S ======> IP / TCP 192.168.1.1:https > 192.168.1.100:ftp_data SA


In case we want to do some expert analysis of responses, we can use the following command to indicate which ports are open:

>>> ans.summary(lfilter = lambda (s,r): r.sprintf("%TCP.flags%") == "SA",prn=lambda(s,r):r.sprintf("%TCP.sport% is open"))
https is open


Again, for larger scans we can build a table of open ports:

>>> ans.filter(lambda (s,r):TCP in r and r[TCP].flags&2).make_table(lambda (s,r):
...             (s.dst, s.dport, "X"))
66.35.250.150 192.168.1.1 216.109.112.135
80  X             -           X
443 X             X           X


If all of the above methods were not enough, Scapy includes a report_ports() function which not only automates the SYN scan, but also produces a LaTeX output with collected results:

>>> report_ports("192.168.1.1",(440,443))
Begin emission:
...*.**Finished to send 4 packets.
*