Downloaded 79 times
Uploaded byChris Harrington
CapAnalysis - Deep Packet Inspection
This document is a user guide for the Capanalysis tool focused on analyzing TCP and UDP flows using deep packet inspection on Linux systems. It covers installation requirements, dataset creation, analysis features including powerful filtering options, and visualization tools like charts and maps for refined data interpretation. The guide emphasizes cost-effectiveness and ease of use for non-technical stakeholders, providing insights through reporting and presentation capabilities.
In this document
Powered by AI
Overview of CapAnalysis for capturing and analyzing TCP & UDP flows, presented by Chris Harrington.
CapAnalysis runs on Debian-based Linux; requires installation of php5-sqlite and php-mdb2-driver-pgsql.
Instructions on accessing CapAnalysis, creating a dataset, and adding capture files for analysis.
Powerful filters available for refined analysis of datasets; includes various filter criteria.
Displays of data streams, protocol usage, statistics, timelines, maps, and detailed IP overviews.
Use advanced filters for better analysis; highlights reporting, geolocation, and cost-effectiveness.
Contact details for further inquiries regarding the CapAnalysis tool.
More Related Content
Similar to CapAnalysis - Deep Packet Inspection
CapAnalysis - Deep Packet Inspection
- 1. For wireless investigations User guide for capture analysis TCP & UDP Flows – deep packet inspection By Chris Harrington
- 2. CapAnalysis runsin Linux OS (x32/x64) ◦ Debian based Pcap viewer Analyze TCP & UDP streams Supports multiple datasets Performs deep packet inspection Reporting and presentation capabilities Using Kali Linux running in VMware workstation for this guide
- 3. Two packagesneed to be installed ◦ php5-sqlite ◦ php-mdb2-driver-pgsql Command: apt-get install php5-sqlite apt-get install php-mdb2-driver-pgsql Restart apache service Start CapAnalysis and Postgresql
- 4.
- 5. Create adataset for suspect’s case
- 6.
- 7. Add capturefiles to analyze
- 8.
- 9. Via netcat Command: cat <pcapfile> | nc ::1 30001
- 10. Click ondataset name to enter analysis
- 11. Powerful filtersare available for quick analysis. Use them for refined analysis
- 12. Filter elements Filterfiles Filter IP/Ports Filter protocols Filter country Filter data size Filter date or time Filter elements Filter files Filter protocols Filter IP/Ports Filter country Filter data size Filter date or time
- 13. Displays allUDP & TCP streams
- 14. Displays protocolsused in dataset flows ◦ by country or by data type
- 15. Statistics overviewof dataset ◦ Quickly identify key information
- 16. Timeline viewof distribution of data Intervals can be set (minimum 5 minutes)
- 17. Map viewof flows, data received and sent ◦ Interactive map
- 18. Displaying allsource and destination IPs clicking on an IP will give detailed overview of that IP
- 19. Chart viewof protocols identification from dataset Click here for different data types Mouse over
- 20. Timeline displayfrom dataset Remember to use filters
- 21. Use advancedfilters for refining analysis Reporting and presentation capabilities ◦ Easy to understand for non technical stakeholders Timelines Dissecting TCP and UDP streams Time saving Cost effective Geolocation of all connections Upload datasets with NetCat (scripting possibilities?)
- 22. My contactdetails C.k.harrington@gmail.com