TCP flow extraction

Question

I need to extract TCP Flows with their content from dump file and then save their flow into other file each flow separately

Answer 1

Wire shark maybe? It can be used to filter sessions and I think you can then save them seperatly.

Answer 2

If you're only doing a few, Wireshark can do this.

Steps:

1. Open up the capture in Wireshark.
2. Click on a packet from the TCP connection you're interested in
3. Analyze -> Follow TCP Stream
4. Click 'Raw'
5. Select (from the popup menu) one of 'Entire Conversation' or one of the two directions.
6. Click 'Save As'

Alternate steps, for HTTP only:

1. Open up the capture
2. Select File -> Export -> Objects -> HTTP
3. A dialog will open showing all the HTTP objects in the capture. You can save some or all of them.

This is with Wireshark 1.2.1 on Linux/GTK. The 'follow TCP stream' option has been moved around between versions, so it may be somewhere else if you have an older version. But its always been called Follow TCP Stream so you should be able to find it.

Quick searching also reveals several other options if Wireshark doesn't work for you: ngrep, tcpick, chaosreader, and tcpflow.

Answer 3

You definitely want to use Bro, more specifically, its contents.bro policy. For example, given a trace that contains HTTP requests, running the following ...

bro -r http.trace -f 'tcp and port 80' contents

... produces files

contents.[senderIP].[senderPort]-[destIP].[destPort]
contents.[destIP].[destPort]-[senderIP].[senderPort] 

for each connection, each containing the unidirectional content of the flow.

The flow reassembly is highly robust, the process scales to very large files, and everything is customizable to your needs.

Answer 4

You could also have a look at NetFlow and related tools.

Answer 5

tcpflow -r my_dump_file.pcap -o output_dir/

It will extract each tcp flow, separately, into a file under output_dir. Each flow in its own file.

Here's the manpage with more options