If you haven’t checked out xtractr already, you should! It’s a RESTful server that indexes large packet captures for the purposes of forensics, data extraction, reporting, etc. While xtractr can generate all sorts of cool reports and charts, they don’t quite capture the dynamic essence of the network. Users come and go, they tweet, machines send queued emails, phone calls fly around, files get transferred. Static reports and visualizations (Top Talkers anyone?) just don’t do justice to this flurry of activity that happens on a network.
Archive for jQuery
Using Map/Reduce for Network Forensics and Troubleshooting
We launched xtractr earlier this week for network forensics, troubleshooting and handling support escalations involving large packet captures. Just so you know xtractr is a 4-tier app (more on that below) that combines the best of Web 2.0 with looking at packets in new light. Looking beyond the “unleash the power of packets” message, I wanted to write about what’s under the hood a little bit and how we are using CouchDB-style of Map/Reduce for uncovering all sorts of information inside large packet captures.
Collaborative Network Forensics
If you’ve dealt with really large packet captures, you’ve probably tried to break things apart into smaller chunks just so you can figure out what’s actually in there. There are lots of command line tools out there that already do this. So it started out as an experiment to see if there’s a better, interactive, visual way to explore large pcaps and rapidly hone in on what you are looking for. With the recent release of large datasets from ITOC the need for this just became a whole lot more critical.
