chaosreader(1) trace network sessions and export it to html format chaosreader(1)

chaosreader - trace network sessions and export it to html format 

chaosreader
chaosreader [-adehiknqrvxAHIRTUXY] [-D dir]
            [-b port[,...]] [-B port[,...]]
            [-j IPaddr[,...]] [-J IPaddr[,...]]
            [-l port[,...]] [-L port[,...]] [-m bytes[k]]
            [-M bytes[k]] [-o "time"|"size"|"type"|"ip"]
            [-p port[,...]] [-P port[,...]]
            infile [infile2 ...]
chaosreader -s [mins] | -S [mins[,count]]
            [-z] [-f 'filter']

Chaosreader traces TCP/UDP/others sessions and fetches application data from snoop or tcpdump logs. This is a type of "any-snarf" program, as it will fetch telnet sessions, FTP files, HTTP transfers (HTML, GIF, JPEG etc) and SMTP emails from the captured data inside network traffic logs. A html index file is created to that links to all the session details, including realtime replay programs for telnet, rlogin, IRC, X11 and VNC sessions. Chaosreader reports such as image reports and HTTP GET/POST content reports.

It also creates replay programs for telnet sessions, so that you can play them back in realtime (or even different speeds).

Chaosreader can also run in standalone mode, where it invokes tcpdump or snoop (a similar to tcpdump program for Solaris) to create the log files and then processes them.

Create application session files (default).
Show DNS names instead of IP addresses.
Create HTML 2-way & hex files for everything.
Print a brief help.
Print verbose help (this) and version.
Print massive help.
Create info file.
Quiet, no output to screen.
Create raw files.
Verbose.
Create index files (default).
Exclude application session files.
Include hex dumps (slow).
Exclude info files.
Exclude raw files.
Exclude TCP traffic.
Exclude UDP traffic.
Exclude ICMP traffic.
Exclude index files.
Create extra files for keystroke analysis.
Include hostnames in hyperlinked HTTPlog (HTML)
Output all files to this directory.
Replay these TCP ports as well (playback).
Replay these UDP ports as well (playback).
Create HTML for these TCP ports as well.
Create HTML for these UDP ports as well.
Min size of connection to save ("k" for Kb).
Max size of connection to save ("k" for Kb)
Sort Order: time/size/type/ip (Default time).
Only examine these ports (TCP & UDP).
Exclude these ports (TCP & UDP).
Standalone. Run tcpdump/snoop for 5 mins.
Standalone, many. 10 samples of 5 mins each.
Standalone, endless. 5 min samples forever.
Standalone, redo. Rereads last run's logs.
Only examine these IPs.
Exclude these IPs.
With standalone, use this dump filter.

Many files will be created, run this in a clean directory. Short example:

Html index (full details).
Text index.
File index for standalone redo mode.
HTML report of images.
HTML report of HTTP GET/POST requests.
Info file describing TCP session #1.
HTML colored 2-way capture (time sorted).
Raw data 2-way capture (time sorted).
Raw 1-way capture (assembled) server->client.
Raw 1-way capture (assembled) client->server.
HTML colored 2-way.
HTTP portion of the above, a HTML file.
HTML colored 2-way.
HTTP portion of the above, a JPEG file.
HTML colored 2-way.
HTTP portion of the above, a GIF file.
An FTP transfer, a gz file.

TCP Sessions.
UDP Streams.
ICMP packets.
HTML Index.
Text Index.
File Index for standalone redo mode only.
HTML report of images.
HTML report of HTTP GET/POST requests.
*.info
Info file describing the Session/Stream.
*.raw
Raw data 2-way capture (time sorted).
*.raw1
Raw 1-way capture (assembled) server->client.
*.raw2
Raw 1-way capture (assembled) client->server.
*.replay
Session replay program (perl).
*.partial.*
Partial capture (tcpdump/snoop were aware of drops).
*.hex.html
2-way Hex dump, rendered in colored HTML.
*.hex.text
2-way Hex dump in plain text.
*.X11.replay
X11 replay script (talks X11).
*.textX11.replay
X11 communicated text replay script (text only).
*.textX11.html
2-way text report, rendered in red/blue HTML.
*.keydata
Keystroke delay data file. Used for SSH analysis.

eg "chaosreader infile", this is where a tcpdump/snoop file was created previously and chaosreader reads and processes it.
eg "chaosreader -s 10" this is where chaosreader runs tcpdump/snoop and generates the log file, in this case for 10 minutes, and then processes the result. Some OS's may not have tcpdump or snoop available so this will not work (instead you may be able to get Ethereal, run it, save to a file, then use normal mode). There is a master index.html and the report index.html in a sub dir, which is of the format out_YYYYMMDD-hhmm, eg "out_20031003-2221".
eg "chaosreader -S 5,12", this is where chaosreader runs tcpdump/snoop and generates many log files, in this case it samples 12 times for 5 minutes each. While this is running, the master index.html can be viewed to watch progress, which links to minor index.html reports in each sub directory.
eg "chaosreader -ve -z", (the -z), this is where a standalone capture was previously performed - and now you would like to reprocess the logs - perhaps with different options (in this case, "-ve"). It reads index.file to determine which capture logs to read.
eg "chaosreader -S 5", like standalone many - but runs forever (if you ever had the need?). Watch your disk space!

Note: this is a work in progress, some of the code is a little unpolished.

The following assumptions may cause problems (check for new vers):

•
Example 1:

    tcpdump -s9000 -w output1        # create tcpdump capture file
    chaosreader output1              # extract recognised sessions, or,
    chaosreader -ve output1          # gimme everything, or,
    chaosreader -p 20,21,23 output1  # only ftp and telnet...
•
Example 2:

    snoop -o output1                 # create snoop capture file instead
    chaosreader output1              # extract recognised sessions...
•
Example 3:

    chaosreader -S 2,5      # Standalone, sniff network 5 times for 2 mins
                            each. View index.html for progress (or .text)

tcpdump(8), snoop(1M), chaosreader help page.

chaosreader was written by Brendan Gregg.

This manual page was written by Joao Eriberto Mota Filho <eriberto@debian.org> for the Debian project (but may be used by others).

18 Nov 2016 chaosreader-0.96