0

I have tcpdump traces from which I want to recover reassemble HTTP requests and responses. Is there a good tool to do that. Python preferred but willing to write a wrapper if python solution not available.

4
  • if there's only a few then you can open the dump in wireshark (then right click on a message and select something like "follow conversation" - can't remember exact term) Aug 26, 2011 at 22:56
  • Thanks but they are not few. I need a scriptable way to do things because I need to further process the conversations from many traces.
    – r.v
    Aug 27, 2011 at 18:57
  • ok. if you don't find any other solution, it it possible to script wireshark with lua. but i have no idea what exactly is involved or whether it would be worthwhile in this case. Aug 27, 2011 at 19:12
  • Thanks, sounds interesting. It may not work for the current project but will be worth looking.
    – r.v
    Aug 27, 2011 at 20:24

3 Answers 3

2

Bro performs robust TCP stream reassembly and parses a variety of application-layer protocols in a port-independent fashion. That is, if your trace contains HTTP traffic on any non-standard HTTP ports, Bro detects it.

Bro's HTTP analyzer does exactly what you need out of the box: it takes the TCP stream and deconstructs it into HTTP headers and bodies, for both requests and responses. Simply run Bro and look at the http.log:

bro -r trace.pcap
less http.log

Bro also comes with Python bindings, meaning, you can send all HTTP events to your custom Python script for individual processing.

0

You're probably looking for tcpreplay.

To appeal to your python sensibilities, you might also want to look at Scapy.

1
  • I do not think tcpreplay has any application layer protocol knowledge. Correct me if I am wrong. Scapy makes things simpler but does not still does not have knowledge of the protocol - like what kind of request it is or what are the headers. Thanks anyway.
    – r.v
    Aug 27, 2011 at 19:01
0
##this_script.bro##
@load-sigs /usr/local/bro/share/bro/policy/frameworks/signatures/detect-payload.sig 
global x: string = "";

redef tcp_content_delivery_ports_orig += {[80/tcp] = T};
event tcp_contents(c: connection, is_orig: bool, seq: count, contents: string)
{
x += contents;
}

event signature_match(state:signature_state, msg:string, data:string)
{
print fmt(msg);
print data;  
}

event bro_done()
{
print x;    #reassemble payload
}

This is a script that displays the tcp stream reassembled payloads on port 80. You can run by bro -i iface_name this_script.bro. This helps you in analyzing the request made

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.