2013-12-05_tcpflow-and-BE-update

More documents

Recommendations

Info

plot_wifi_aps.py will transform this into a ‘dot’ output$ python plot_wifi_aps.py report.xml > report.dot$ circo -Tpdf report.dot > report.pdf00:17:13:8a:44:d700:15:13:64:42:13 linksys00:0c:13:28:43:c3Janice00:19:13:00:4d:ac00:02:13:8d:47:57HOTEL00:15:13:64:4f:be00:02:13:d7:45:79Michael00:14:13:ce:48:84 Hunter 00:14:13:ce:48:8500:02:13:5c:40:8cSuper SpfiZALMOD-SEC00:19:13:4b:48:6dZALMOD00:0c:13:4f:43:3944
<strong>tcpflow</strong> — future improvementsBuffer connections in RAM — FasterIncorporate ssldump — Decrypt SSL connections (for a while)Improved visualizations — Useful in the fieldWireshark integration• Lots of people are using Wireshark• Use <strong>tcpflow</strong> to re-implement Wireshark’s “follow TCP connection”• Or use Wireshark’s ‘dissectors’ in Wireshark.45
Page 1 and 2: TCPBEflowTCP analysis with tcpflow;
Page 3 and 4: tcpflow is a command-line tool for
Page 6 and 7: tcpflow turns each side of the TCP
Page 14 and 15: tcpflow automatically bins connecti
Page 16 and 17: eport.xml is a DFXML file that reco
Page 18 and 19: tags generated by tcpflow match fiw
Page 20 and 21: Harassment atNITROBAState Universit
Page 22 and 23: To find out what's going on,Nitroba
Page 24 and 25: How to solve this problem:NITROBASt
Page 26 and 27: Slides omitted
Page 28 and 29: tcpflow addresses important “real
Page 30 and 31: 26tcpflow makes transcripts from ea
Page 32 and 33: 28tcpflow makes transcripts with mi
Page 34 and 35: 30tcpflow will detect and split gig
Page 36 and 37: tcpflow 1.4 uses the bulk_extractor
Page 38 and 39: SSL decryption issuesOptions for de
Page 40 and 41: The actual cipher suites used when
Page 42 and 43: 808023One-page visualization of pac
Page 44 and 45: Radiotap information available at T
Page 46 and 47: 802.11 link-layer information avail
Page 50 and 51: BEbulk_extractorimprovements
Page 53 and 54: zip.txt — potential zipfile heade
Page 55 and 56: Beverly, Robert, Simson Garfinkel a
Page 57 and 58: Are low-level binary network data s
Page 59 and 60: Hibernation decompression found eve
Page 61 and 62: BE 1.3 put MAC addresses in ether.t
Page 63 and 64: ip_histogram.txt removes random noi
Page 65 and 66: pcap files are a common file format
Page 67 and 68: We find a lot of packets on disks!A
Page 69 and 70: The big picture:using low-probabili

2013-12-05_tcpflow-and-BE-update

Create successful ePaper yourself

Delete template?

Save as template?