Chaosreader: Trace TCP/UDP from snoop/tcpdump logs

From: Brendan Gregg (brendan.gregg_at_tpg.com.au)
Date: 01/27/04

  • Next message: Mandrake Linux Security Team: "MDKSA-2004:008 - Updated tcpdump packages fix several vulnerabilities" 
    Date: Tue, 27 Jan 2004 19:03:49 +1100 (EST)
To: <bugtraq@securityfocus.com>

    Vunerability Analysis Tool

    Chaosreader is a freeware tool that can trace HTTP sessions from a packet
    log, displaying which bytes are plaintext. It could be used to help verify
    that some websites really do use encryption, which may interest readers of
    Bugtraq. It has been written in perl and tested on RedHat, Solaris
    and Windows.

    The above description is one use of Chaosreader, it has many features:

            Reads snoop and tcpdump logs
            Processes TCP, UDP, ICMP, IPv4 and IPv6
            Processes HTTP transfers (HTML, JPG, GIF, zip, ...)
            HTTP GET/POST content reports
            HTTP traffic log reports
            SMTP emails
            FTP files (active transfers)
            IRC sessions
            telnet sessions (also generates realtime playback scripts)
            X11 sessions (experimental X11 playback feature)
            Hex dumps
            ...

    In some ways it's like an "any-snarf" program as it fetches the
    application data from the network traffic logs to capture HTTP and FTP
    files, and generate playback programs for telnet, IRC, etc.

    So far it's helped to convince people to use encryption - ssh or IPSec.

    Quick Usage:
                    snoop -o /tmp/out1
                    chaosreader /tmp/out1
                    netscape index.html

    Main Website:
            http://www.brendangregg.com/chaosreader.html

    Or just web search for "chaosreader".

    There are many existing (and more developed) tools that provide
    similar features, such as Ethereal and dsniff; and some of the ideas
    are similar to tools like lazarus and ttywatcher.

    More features (and bug fixes) will be added in future versions.

    Enjoy!

    Brendan Gregg

    [Sydney, Australia]

  • Next message: Mandrake Linux Security Team: "MDKSA-2004:008 - Updated tcpdump packages fix several vulnerabilities"

    Relevant Pages

    • [Full-Disclosure] Chaosreader: Trace TCP/UDP from snoop/tcpdump logs
      ... displaying which bits are plaintext. ... The above description is one use of Chaosreader, it has many features. ... Full-Disclosure - We believe in it. ...
      (Full-Disclosure)
    • Chaosreader: Process snoop logs into TCP/UDP streams
      ... As snoop output files have been discussed previously on comp.unix.solaris, ... Chaosreader is a freeware tool to take a snoop log and parse ... More features will be added in future versions, ...
      (comp.unix.solaris)
    • Chaosreader ver 0.93
      ... Chaosreader version 0.93 has been released. ... that processes application data from network capture files. ... The following lists protocol by TCP/IP ... More features will be added in future versions. ...
      (comp.security.unix)