1

I've been analyzing my network traffic lately with the use of Wireshark, and found it interesting where it all ends up.

The only downside to this is the heaps of ip addresses and meticulous work that I've had to do creating display filter macros, tracing ip addresses and their ranges (eg 1e100.net/Google 216.58.192.0-255).

The question: Out of curiosity, has anyone here used any program that automatically resolves the DNS of a site based on some form of database of who the ip connects to (parent, child in the node) and arranges that data into categories? Like 'CDNs' 'Hosting Sites' 'Private Blogs' 'Streaming' etc. Would be nice to have some form of automation in this, that way I could focus on that one dirty needle in the hay stack abyss.

Maybe something that says 'hey this IP has been blacklisted or reported x amount of times in the last year' etc. IP Geographic data with heatmaps from where the most request are coming from.

Something comprehensive, and robust. Or maybe just something interesting you've used before to analyze network traffic and would like to share.

Thanks!

3

A very powerful and capable alternative, or complement, to Wireshark is scapy which itself is a library for Python the original version runs under python 2 but there is also an effort to port to python 3.

  • Free, Gratis & Open Source
  • Cross Platform
  • Analysis of existing wireshark file
  • Very powerful filtering
  • Perform Capture itself from an interactive session or a script
  • Advanced trace route, etc., tools
  • passive OS fingerprinting
  • Table generation
  • Interface to GNUPlot for various graphing options
  • Interface to Graphviz and ImageMagick for diagramming
  • Interface to VPython for 3-D Visualisation

Hugely powerful it is often used both for network capture analysis but also for pentesting as it can inject network traffic as well as monitor it.

A couple of impressive examples from the demos page:

>>> res,unans = traceroute(["www.microsoft.com","www.cisco.com","www.yahoo.com","www.wanadoo.fr","www.pacsec.com"],dport=[80,443],maxttl=20,retry=-2)
Received 190 packets, got 190 answers, remaining 10 packets
   193.252.122.103:443 193.252.122.103:80 198.133.219.25:443 198.133.219.25:80  207.46...
1  192.168.8.1         192.168.8.1        192.168.8.1        192.168.8.1        192.16...
2  82.251.4.254        82.251.4.254       82.251.4.254       82.251.4.254       82.251...
3  213.228.4.254       213.228.4.254      213.228.4.254      213.228.4.254      213.22...
[...]
>>> res.graph()                          # piped to ImageMagick's display program. Image below.
>>> res.graph(type="ps",target="| lp")   # piped to postscript printer
>>> res.graph(target="> /tmp/graph.svg") # saved to file 

Results in: enter image description here

You also can have a 3D representation of the traceroute. With the right button, you can rotate the scene, with the middle button, you can zoom, with the left button, you can move the scene. If you click on a ball, it's IP will appear/disappear. If you Ctrl-click on a ball, ports 21, 22, 23, 25, 80 and 443 will be scanned and the result displayed.

>>> res.trace3D()

enter image description here

Some of the capabilities are listed in the interactive tutorial.

  • 1
    Awesome I'll look into this software it sounds close to what I want. Would be a tad more convenient than writing lua scripts to do what I need. Thanks for the help! – BeepBoopBeep Dec 23 '16 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.