Announcing pcapr.Local

April 18, 2011 by kowsik

Since the launch of pcapr.net a few years ago, the packet-geek community has completely embraced it, extended it and now we are at over 60+ million packets on the cloud, serving enterprise IT folks, operators, government agencies and security/packet geeks. To those that seek specific packet samples, pcapr.net serves as a major reference with samples of over 420+ protocols, full-text search and the automatic indexing and organization of pcaps. But…

Introducing pcapr.Local

Over the course of the last couple of years, we’ve had a number of requests from our pcapr users asking for a private, on-premise version of the same. Face it, there are pcaps that you will never share and we want you to hold on to these while still exploiting the big-data technologies like CouchDB to analyze and mine the data contained in those pesky little packets.

We are happy to announce pcapr.Local, a private repository of sorts that indexes your entire pcap collection so you can organize them, share them internally and quickly run all kinds of analysis across those pcaps.

What is pcapr.Local?

It’s a Sinatra/CouchDB/tshark/xtractr app that does three-way reconciliation of your pcaps, the xtractr indexes and CouchDB similar to what Picasa does to images or iTunes does to your music collection. You can find the code at

https://github.com/pcapr-local/pcapr-local

Simply dump all your pcaps into the configured pcaps directory and we’ll index these things in the background and stick all the meta-data in CouchDB for you so you can organize your collection of pcaps and collaborate internally. It’s also fully RESTful so you can run various intra-pcap analysis and get what you need.

pcaprlocal.png

Some simple use cases:

For all pcaps:

  • in a specific directory, find out the top talkers
  • with a certain duration, find out the top DNS domain names
  • containing a certain protocol, extract specific fields from those protocols
  • containing HTTP flows, slice these out and save them as separate pcaps

Screenshots

Here are some obligatory screenshots that show what pcapr.Local can do.

Overview

This displays all the pcaps in chronological order, along with the various meta-data pulled out from xtractr.

pcaps.png

Services

How many times did you wonder what kinds of protocols you had in your collection? With the tag-cloud that spans your local pcap repository, you can easily find and sort through all of your pcaps that have a specific protocol.

tag-cloud.png

Analysis on a single pcap

Run various reports on a given pcap to find out what you need. This includes visualization of the flows over time and other reports. These reports are contextual and are generated based on the contents of that particular pcap.

SIP Call Extraction

If you’ve tried to pull out a slice of a pcap that contains SIP and RTP on a multi-legged call, you know how painful it is. With pcapr.Local, it’s just a click away.

call-extraction.png

Next Steps

With pcapr.Local, you can put an end to trying to find the right internal pcaps to solve your problems. All you have to do is:

gem install pcapr-local

Categories: Announcements, CouchDB, Forensics, pcapr, Wireshark, xtractr
1,664 Comments
Bookmark and Share