2013-12-05_tcpflow-and-BE-update

pcap files are a common file format for packets.There are many tools for analyzing pcap files.$ tcpdump -r packets.pcap-5:-59:-59.0000 IP 192.168.1.1.microsoft-ds > 192.168.1.104.udpradio: Flags [.], ack416616880, win 65535, length 0-5:-59:-59.0000 IP 192.168.1.1.microsoft-ds > 192.168.1.104.udpradio: Flags [.], ack4294967234, win 65535, length 0-5:-59:-59.0000 IP 192.168.1.1.microsoft-ds > 192.168.1.104.udpradio: Flags [.], ack4294967084, win 65535, length 0-5:-59:-59.0000 IP 192.168.1.1.microsoft-ds > 192.168.1.104.udpradio: Flags [P.], seq4294966956:4294967060, ack 4294967008, win 65535, length 104SMB PACKET: SMBtrans2(REPLY)...Notice time is -5:-59:-59.000• This has a time zone of -0600 (I’m typing this in Utah in the summer)• The time in the packet file is “1”/* Possibly a valid ethernet frame but not preceded by a* pcap_record_header.* Write it out with time of 1.*/• Only packets carved from a PCAP file will have a the correct time.62