Re: TCPDump porting issues
Re: TCPDump porting issues
- Subject: Re: TCPDump porting issues
- From: Bill Bumgarner <email@hidden>
- Date: Tue, 14 Aug 2001 17:13:16 -0400
If you search softrak, someone also put together a very nice/convenient
installer package containing the latest version of tcpflow which is a
bit more convenient to use than tcpdump (it uses the same underlying
mechanism but is designed more for monitoring conversations than for
generic dumping... or so I think).
I also wrote a little python script that can reconstruct HTTP
conversations based on the raw output from tcpflow. It can also filter
for specific headers (and does not display raw data).
Very handy if you figure out exactly what the hell is happening to
cookies on an HTTP conversation.
It could easily be extended to handle SMTP, FTP, whatever-- the script
project is designed to go there, I just haven't had need.
b.bum