Tool for network traffic analysis of a custom protocol - wireshark

The protocol is very simple and is developed on top of TCP. I need to analyze a big libpcap dump file to calculate the average value and standard deviation of the conversation time and of the number of packets per conversation.
Using Wireshark it's simple to analyze the TCP conversations between the endpoints, but the summary includes all of the TCP packets (lots of SYNs, ACKs and FINs), and this messes up the data.
Is there another tool to do this kind of analysis? Is there a way to EASILY extend Wireshark's functionality?

You can check out the Argos custom protocol analyzer.
It is a commercial tool and it has a powerful and easy to use XML protocol definition language.
Additionally it can monitor Ethernet and IP traffic as Wireshark does and open Libcap files

Not sure I understand exactly what you need, but if you're looking to analyze only the packets with application data in them you can ask Wireshark to display only those packets with the PSH ("push to application") flag set.

What exactly this protocol contains? Is there any specific header for its own usage? Wireshark provides many complex filtering options that you can explore.
If you want to do it using program, you can try PCAP or PF_SOCK. You may need to write your own filtering criteria then.

Is there another tool to do this kind of analysis? Is there a way to
EASILY extend Wireshark's functionality?
You can try Scapy ( http://www.secdev.org/projects/scapy/ ), with Scapy it is very easy to add new protocols: http://www.secdev.org/projects/scapy/doc/build_dissect.html .
Scapy is not as Wireshark, but I think it will solve your problem.

Related

comparison between mqtt and coap using omnetpp

I want to compare MQTT and CoAP application layer protocols on reliability and power consumption in simulator: omnetpp.
Does Omnetpp support these two protocols?
Is there any existing open source project that I can check?
I watched a youtube video and found that the author just have a simple parameter in the omnetpp.ini file: IOT.*.protocol = "MQTT" or "COAP". This is not standard option right? I wonder what extra work has to be done.
Thanks in advance,
Alex
CoAP and MQTT models are not available for OMNeT++. In the video, the guy is definitely showing his own project.
You can create the MQTT simulation model by modifying the TCP applications given in INET and use your own message class with MQTT payload.

How to generate H323 (Including H225 & H245) protocol packets?

I'm trying to write a simple DPI (Deep Packet Inspection) tool. In my current phase, I need to develop a H.323 protocol detector. To aim this goal I need a H.225 / H.245 packet generator. I seems that almost all tool use SIP and RTP & RTCP protocol. Does anybody have any idea which tool use H323 protocols in VOIP?
There is number of h323 libraries, some of them are openh323 and openoh323/openooh323.
But ALL libraries have issues and alot of bugs. Main issue - protocol is VERY complex if compare with sip or other modern protocols and ALL vendors do "vendor-specific" addons/changes in protocol way they think "better for client".
As result it is hard to work with any tools. Easy way detect is just get signatures like 'h323', 'rtp' etc.

How to use wireshark dissectors in own application without wireshark at all?

Im using libpcap and want to be able to analyze packets but without wireshark at all. However, I want to use the wireshark dissectors. Has anybody done this and can give me an explanation for the needed steps?
First of all see this answer about the dangers of using epan and linking to libwireshark. You're basically alone trying to make it work, it is not meant to work that way and a new version may break your code. It is always suggested to write a dissector instead since that API is not going to change.
If that did not scare you please read forward.
I have not performed it but i'm more-or-less familiar with the wireshark code tree. I believe that what you're after is the #include <epan/packet.h>, #include <epan/frame_data.h> and #include <epan/tvbuff.h> (Testy Virtual Buffer), these header files are distributed together with wireshark since are needed to write plugin dissectors.
Since one protocol often contains another protocol as the payload wireshark's way to deal with is the tvbuff_t. One dissector returns a tvbuff_t which can then be used by another dissector. You need to perform the entire decoding of the packet, (for example, starting from Ethernet) since wireshark is not there to do it for you.
The code in the epan directory is documented in the doc directory, notably the section 1.7 of doc/README.dissectors (Calling Other Dissectors) has information on how to use tvbuff_t and find_dissector().
It is a very hacky way of doing things, therefore i'll warn again: if you can get away with writing a dissector and use it within wireshark, do it.
I found the following Project on Github:
https://github.com/gnychis/android-wmon
One has to do some modifications in order to get it work, but much much easier than starting from the beginning.

tcpdump capture files analysis

I generated some communications between client/server and captured the packets using tcpdump. Now I want to analyze those packets to measure latencies and some other information, like any packet lost or acks lost. Is there any way to do this. I was trying to write scripts in perl to analyze it. There is a perl implementation call net::tcpdump. But the documentation is not very detailed. I don't event know how to extract the time stamps.
Any idea would be appreciated.
If you are willing to switch to Python, I have found impacket useful for writing some custom .pcap analysis scripts. The tcptrace tool also has some analysis features not available in Wireshark
Wireshark has some packet statistical tools - and can read the capture files produced by tcpdump.

Available Game network protocol definition languages and code generation

I've been looking for a good general purpose binary network protocol definition framework to provide a way to write real-time game servers and clients (think World Of Warcraft or Quake III) in multiple languages (e.g. Java backend server and iPhone front-end client written in Objective-C and Cocoa).
I want to support Java Flash clients, iPhone clients and C# clients on windows (and XNA clients on XBOX).
I'm looking for a way to efficiently send/receive messages over a TCP/IP or UDP socket stream connection. I'm not looking for something that can be sent over an HTTP Web Service, like JSON or XML marshalled Objects. Although Hessian's binary web service protocol is a very interesting solution
I want a network protocol format and client/server basic implementation that will allow a client to connect to a server and send any message in the defined protocol and receive any message in the protocol without having to bind to some kind of RPC endpoint. I want a generic stream of any message in my protocol incoming and outgoing. This is so that I can support things like the server sending all clients the positions of various entities in the game every 100 milliseconds.
The network protocol frameworks I've found are as follows:
Google's Protocol Buffer - but it lacks support for things like sending/receiving arbitrary messages from your given protocol.
Apache Thrift - an interesting option but it is geared mainly towards RPC instead of generic game client/server socket type connections where the client or server can send messages at any time and not just in response to a client RPC request.
Raknet Multiplayer - Raknet provides full multiplayer network library (it's free for indie development with revenue under $250k)
UPDATE : OculusVR Acquired RakNet and its Free/OpenSource now. U can find it on Github
Hessian Binary Web Service Protocol - is a HTTP web service binary protocol, it is well-suited to sending binary data without any need to extend the protocol with attachments.
Raknet provides a good game/simulation oriented multiplayer library.
Apache Thrift and Google's protocol buffers seem to be the simplest approaches to using in a game network protocol client/server architecture.
Hessian seems like a great fit if you want to create a web based game server with a Java or flash client using some type of server push technology like COMET. Hessian might provide a really interesting way to support real-time games on the web and even be able to host them on VM web solutions like Google's App engine or Amazon's EC2.
There's some discussion about using various protocol definition frameworks for games and other uses:
Comparison of Various Serialization Frameworks
Thrift vs Protocol Buffers - Thrift is declared the better framework because it has a fully supported RPC client/server implementation
Using Protocol Buffers for client server Game API determining what type of message to decode
Bi-Directional RPC using thrift
DIS
If you do go the route of writing your own protocol, you may want to read the answer I posted here.
In summary it discusses what you should think about when writing a protocol, and list a few tricks for versioning and maintaining backwards and forward compatibility.
If you are really concerned about multiple platforms and language, be sure to take into account endian issues. A binary protocol designed for this use must use network-byte-order, so it needs custom per-data-type serialization functions; you cannot just blindly push C structs into network buffers.
A common solution for this problem at game companies is to have protocol description language or specification in a simple format like XML or python or lua, and then have code generation for each target language that generated packet classes with both data structure and serialization. This specification could use a type system that starts with basic types, then extends to include game-specific types with semantic information, enumerations or more complex structures. For example a data file could look like:
Attack = {
source = 'objectId',
target = 'objectId',
weapon = 'weapon::WEAP_MAIN',
seed = 'int'
}
This could generate code like:
#define PT_ATTACK 10002
class PacketAttack : public Packet {
public:
PacketAttack () : m_packetType(PacketAttack::s_packetType) {}
ObjectId m_source;
ObjectId m_target;
WeaponType m_weapon;
int m_seed;
bool Write(Stream* outStream) {
Packet::Write(outStream);
outStream << m_source;
outStream << m_target;
outStream << m_weapon
outStream << m_seed;
}
bool Read(Stream* inStream);
static const int s_packetType;
};
This does require some more infrastructure.. streams, packet base classes, safe serialization functions..
I want to echo Bill K's suggestion. It's not hard to roll your own protocol.
For the iPhone side, have a look at AsyncSocket which support for delimiter based TCP packets built in, and it's not hard to build a solution which uses packet headers.
If you quickly want to have a testserver to play against AsyncSocket on the iPhone, you can look at Naga (for the java server part) which has ready made stuff both for delimiter based packets and packets with headers. Naga was partially written with networked games in mind.
I disagree with "roll your with simple delimited strings approach": question is, what exactly would be the benefit? Getting to write and maintain more code?
The only reasons I could see would be lack of tool support (writing for some odd platform), or specific (very) hard performance or message size constraints.
Or, sometimes, really wanting to write a format -- that's ok, but it must be an explicit reason.
Depending on exact needs I would suggest considering JSON, since it can read and write arbitrary messages; has good object binders for Java (just like xml), is easier to read than binary formats, and is all around "good enough" for many use cases.
If message size is very important, Protobuf can work well -- while its size is not always as small as gzipped alternatives (gzip+xml, gzip+json compress very well), it's usually close.
ASN.1 fits the definition of "good general purpose binary network protocol definition framework". It's also standardized by ITU-T, so there's a lot of existing tools and libraries for various languages.
The DER encoding is suitable for efficient network communications, the XER encoding for human-readable (and writable) permanent storage.
Because you want to use different languages and also because you want something clean/small, I suggest the protocol buffers of google. You need a pre-compile part for the RPC but I really think that's the best option when you begin to mix different languages.. Here's the link: http://code.google.com/apis/protocolbuffers/docs/overview.html
Why not implement UDP directly? Your question mostly mentions what you don't want.. What further form of abstration do you want on top of UDP?
Download the Quake III sourcecode and see how they frame game updates over UDP?
The IP protocol has been designed to support multiple devices/OSes in a uniform way, isn't this what you ask for?
What protocol has implementations across a huge range of systems, hmm, IP perhaps?

Resources