0

I saved some dump from tcpdump using

tcpdump -n -i eth0 -tttt -Q in > "dump01.dump"

so i got output like this:

20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
20:39:12.835025 IP 213.xx.xx.25.51197 > 151.xx.xx.xx.61479: Flags [P.], seq 4125053309:4125053343, ack 1004545214, win 194, length 34
20:39:12.936971 IP 222.xxx.xxx.182.59953 > 151.xx.xx.xx.61479: UDP, length 287
20:39:12.948822 IP 195.xx.xxx.30.62384 > 151.xx.xx.xx.61479: UDP, length 101
20:39:12.987527 IP 79.xxx.xxx.216.56394 > 151.xx.xx.xx.443: Flags [P.], seq 700421627:700422382, ack 377141587, win 257, length 755
20:39:12.988554 IP 79.xxx.xxx.216.55621 > 151.xx.xx.xx.443: Flags [P.], seq 3192357072:3192357827, ack 3940752659, win 260, length 755
20:39:12.989291 IP 79.xxx.xxx.216.56517 > 151.xx.xx.xx.443: Flags [P.], seq 3172129891:3172130644, ack 3568957121, win 257, length 753
20:39:12.990879 IP 79.xxx.xxx.216.56394 > 151.xx.xx.xx.443: Flags [.], seq 755:2207, ack 1, win 257, length 1452
20:39:12.991845 IP 79.xxx.xxx.216.56394 > 151.xx.xx.xx.443: Flags [P.], seq 2207:3465, ack 1, win 257, length 1258
20:39:12.992794 IP 79.xxx.xxx.216.56254 > 151.xx.xx.xx.443: Flags [P.], seq 1723903877:1723904632, ack 3204952387, win 260, length 755

of course I replaced part of IP's with xxx.

Now the more interesting part - I was DDoSed by someone and I captured whole attack on dump, but I want to see graph of this incident. Unfortunately, as I didn't used -w with tcpdump my output isn't binary and Wireshark refuses to import file - it tries to read hex data with isn't there.

Is there a way to force Wireshark to load this dump without packets details, convert my file or use another program to print graph for me?

  • What does "graph" mean? – thrig Sep 11 '17 at 21:08
  • I meant graphic view, something like that: i.imgur.com/u53kWzB.png (example from other dump) – Bielecki Sep 11 '17 at 21:31
  • What's that a graph of? I'd probably feed the timestamps to R if I wanted latency calculations or whatnot – thrig Sep 11 '17 at 22:52
  • On right side are packets per second, on bottom time/date. I need to see how many packets I got in certain time in a friendly way – Bielecki Sep 12 '17 at 9:20
1

If you are only interested in the timestamp of the packets, then you can snapshot a single packet in hex and replicate it, changing only the timestamp, using text2pcap, which is usually in the same package as wireshark.

For example, I used tcpdump -XX to capture some artibrary packets and chose a short tcp one from the ascii dump:

16:51:27.374569 IP 192.168.0.21.nut > 192.168.0.20.53910: Flags [R.] ...
    0x0000:  b827 0099 9999 80ee 7399 9999 0800 4500  ................
    0x0010:  0028 06e4 4000 4006 b272 c0a8 0015 c0a8  .(..@.@..r......
    0x0020:  0014 0da5 d296 0000 0000 ee15 7872 5014  ............xrP.
    0x0030:  0000 e792 0000                           ......

You can filter this through a bit of awk to get the dump in the format wanted by text2pcap, namely:

awk '$1~/0x/ { $0 = substr($0,1,50); for(i=2;i<=9;i++)s = s $i }
     END     { gsub(/../,"& ",s); print "0000 " s }'

Set variable mypacket to the result:

mypacket='0000  b8 27 00 99 99 99 80 ee 73 99 99 99 08 00 45 00 00 28 06 e4 40 00 40 06 b2 72 c0 a8 00 15 c0 a8 00 14 0d a5 d2 96 00 00 00 00 ee 15 78 72 50 14 00 00 e7 92 00 00'

Then use another awk to take the time from column 1 of each line of your data file and prepend it to this same packet, telling the conversion program to extract this timestamp in the given format, and get it converted to pcap format suitable for wireshark.

awk <dump -v mypacket="$mypacket" '
 /79\.xxx\.xxx\.216/ { print $1 " " mypacket }' |
text2pcap -t '%H:%M:%S.' - out.pcap

Note the final "." in the -t option. It is needed to preserve the fractions of seconds in the timestamp.

1

The text could be converted to PCAP, insofar as that is possible from the limited information present in the tcpdump output, e.g.

#!/usr/bin/env perl
use 5.14.0;
use warnings;
use Time::Piece;

# get this from CPAN
use File::PCAP::Writer ();
my $fpw = File::PCAP::Writer->new( { fname => 'out.pcap' } );

# read tcpdump output from files or standard input
shift @ARGV if @ARGV == 1 and $ARGV[0] eq '-';
while (readline) {
    my ( $stamp, $usec ) = $_ =~ m/^(\d\d:\d\d:\d\d) [.] (\d+) \s IP \s /ax;

    # blindly assume packets all from the same day that is today
    my $now = localtime;
    $stamp = $now->ymd . ' ' . $stamp;

    my $epoch = Time::Piece->strptime( $stamp, "%Y-%m-%d %H:%M:%S" )->epoch;

    # fake an empty packet. this gets timestamps into Wireshark,
    # which may suffice to only graph packets per time
    $fpw->packet( $epoch, $usec, 0, 0, '' );
}

though more code would be necessary to properly handle timestamps that roll to the next day (or, oops, to some subsequent date?) and to properly fake packets with the hints given in the tcpdump output (e.g. make a frame, make IP (with the IP addresses), make a TCP or UDP packet of the correct size and ports, what about ARP and other protocols, etc etc etc).

For instead packets per second from the timestamps without the fuss of PCAP, one could first use an epoch-to-packets-seen-in-that-second script:

#!/usr/bin/env perl
use 5.14.0;
use warnings;
use Time::Piece;

# start epoch
my $day = 1505199600;

my $counter   = 0;
my $prev_secs = -1;
my $prev_ts;

shift @ARGV if @ARGV == 1 and $ARGV[0] eq '-';
while (readline) {
    my ($hhmmss) = $_ =~ m/^(\d\d:\d\d:\d\d) [.] /ax;
    my $secs = Time::Piece->strptime( $hhmmss, "%H:%M:%S" )->epoch;

    # KLUGE assume next day
    $day += 86400 if $secs < $prev_secs;
    my $timestamp = $day + $secs;

    if ( defined $prev_ts and $timestamp != $prev_ts ) {
        say "$prev_ts $counter";
        $counter = 0;
    }

    $counter++;
    $prev_secs = $secs;
    $prev_ts   = $timestamp;
}

say "$prev_ts $counter";

And then feed the converted tcpdump output to R for plotting (I faked a timestamp from a subsequent day as all of yours are from the same second):

$ head -1 dumptext 
20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
$ tail -1 dumptext 
00:31:18.123456 IP 79.xxx.xxx.216.56254 > 151.xx.xx.xx.443: Flags [P.], seq 1723903877:1723904632, ack 3204952387, win 260, length 755
$ perl torrr dumptext > dataforr
$ cat dataforr 
1505273952 10
1505287878 1
$ R
> x=read.table("dataforr")
> x
          V1 V2
1 1505273952 10
2 1505287878  1
> names(x)=c('date','packets')
> x$date=strptime(x$date,"%s")
> x
                 date packets
1 2017-09-12 20:39:12      10
2 2017-09-13 00:31:18       1
> plot(x,type='l')
> 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.