TCP flow extraction

Question

I need to extract TCP Flows with their content from dump file and then save their flow into other file each flow separately

In

Answer 1

You definitely want to use Bro, more specifically, its contents.bro policy. For example, given a trace that contains HTTP requests, running the following ...

bro -r http.trace -f 'tcp and port 80' contents

... produces files

contents.[senderIP].[senderPort]-[destIP].[destPort]
contents.[destIP].[destPort]-[senderIP].[senderPort] 

for each connection, each containing the unidirectional content of the flow.

The flow reassembly is highly robust, the process scales to very large files, and everything is customizable to your needs.

Quenchless

This somehow doesn't work. I cannot find contents.bro anywhere. – Clevelandclevenger

In recent Bro releases, look for scripts/base/protocols/conn/contents.bro. – Quenchless

Answer 2

If you're only doing a few, Wireshark can do this.

Steps:

1. Open up the capture in Wireshark.
2. Click on a packet from the TCP connection you're interested in
3. Analyze -> Follow TCP Stream
4. Click 'Raw'
5. Select (from the popup menu) one of 'Entire Conversation' or one of the two directions.
6. Click 'Save As'

Alternate steps, for HTTP only:

1. Open up the capture
2. Select File -> Export -> Objects -> HTTP
3. A dialog will open showing all the HTTP objects in the capture. You can save some or all of them.

This is with Wireshark 1.2.1 on Linux/GTK. The 'follow TCP stream' option has been moved around between versions, so it may be somewhere else if you have an older version. But its always been called Follow TCP Stream so you should be able to find it.

Quick searching also reveals several other options if Wireshark doesn't work for you: ngrep, tcpick, chaosreader, and tcpflow.

Roxieroxine

Answer 3

tcpflow -r my_dump_file.pcap -o output_dir/

It will extract each tcp flow, separately, into a file under output_dir. Each flow in its own file.

Here's the manpage with more options

Vindictive

You need to add -a to unzip gzipped data – Boynton

Answer 4

Wire shark maybe? It can be used to filter sessions and I think you can then save them seperatly.

Vituperate

Answer 5

You could also have a look at NetFlow and related tools.

Tetanic