Hi Richard,<br><br>Thanks for the info, the argus command line works a treat, with a little massaging with sed I have something workable.<br><br>The tshark command does not work with such a large pcap file, it just errors with 'could not be opened: value too large for defined data type"
<br><br>thanks<br>Ivan<br><br><div class="gmail_quote">On Dec 9, 2007 3:47 PM, Richard Bejtlich <<a href="mailto:taosecurity@gmail.com">taosecurity@gmail.com</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div><div></div><div class="Wj3C7c">Ivan wrote:<br><br>> Does anyone have any ideas for flow information extraction from a rather<br>> large pcap file, 6 gigs?<br>><br>> I am after the standard stuff, source, destination, service.
<br>><br>> Ethereal/wireshark is a no go, as it won't process the file due to size,<br>> tcpflow is OK, but a little untidy.<br>><br>> any suggestions are appreciated, preferably open source and also<br>
> has anyone used "tcpdstat" for something like this?<br><br>Ivan,<br><br>Argus (<a href="http://qosient.com/argus" target="_blank">qosient.com/argus</a>) is your friend, e.g:<br><br>argus -r your.pcap -w - | ra -n -z -L0
<br><br>Russ McRee wrote a nice Argus 3 intro here:<br><br><a href="http://holisticinfosec.org/toolsmith/docs/november2007.pdf" target="_blank">http://holisticinfosec.org/toolsmith/docs/november2007.pdf</a><br><br>Tcpdstat is not the right tool for this task. If you do want summary
<br>stats, Tshark does a better job:<br><br>tshark -n -r your.pcap -q -z io,phs<br><br>I cover these in my books and blog.<br><br>Sincerely,<br><br>Richard<br><br></div></div>_______________________________________________
<br>Full-Disclosure - We believe in it.<br>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia -
<a href="http://secunia.com/" target="_blank">http://secunia.com/</a><br></blockquote></div><br>