Description: Tranalyzer2 is a lightweight flow generator and packet analyzer designed for practitioners and researchers. Special value is set to simplicity, performance and scalability. It extends Cisco NetFlow's functionality and supports analysts in processing ultra large packet dumps. It supports the drill down process to the very flow of interest, which can then be analysed in depth by tcpdump, Wireshark or by its text based packet mode. The program is implemented in C and built upon the libpcap library. Tranalyzer provides functionality to analyze and generate key parameters and statistics from IP traces either being live-captured from Ethernet interfaces or pcap files. The quantity of binary and text based output of Tranalyzer depends on enabled plugins. Hence, users have the possibility to tailor the output according to their needs. Moreover, additional plugins can be developed independently of the functionality of other plugins.Last changelog:
mongoSink ========= - Fixed double escaping of quotes and double quotes
voipDetector ========== - Renamed voipconv to t2voipconv - t2voipconv: added support for AMR, AMR-NB, AMR-WB, G.723.1, G.726, G.726le and GSM formats - Various fixes and improvements
t2utils.[ch] ======== - New functions: t2_strncpy_escape(), t2_strcpy_escape()
tawk ==== - Fixed header printing when accumulating something other than flows - Added support for Termshark (-k option) - shark: added support for SDP, extended support for RTP and SIP - New functions: + ientropy: compute the information entropy of each column, filter out columns with low entropy + isset: return true if a value is set, i.e., not empty + log2: compute the binary logarithm (log base 2) of a number + quote: add leading and trailing quotes to a string, escape quotes within string + printinf, printok, printwrn: print text in blue, green or orange - Improved documentation - Various fixes and improvements
t2fm ==== - Added bottom N statistics - Added --top/--bottom options to only compute top or bottom stats - Do not count query names from responses when reporting top DNS queries - Various fixes and improvements
t2utils.sh ======= - Added validate_next_file_or_dir function - Added {BLUE_,GREEN_,ORANGE_,RED_,}{ITALIC,UNDERLINE} and STRIKETHROUGH variables - Various fixes and improvements
t2_aliases ======== - New t2voipconv alias
New script ======== - t2voipconv: convert and manipulate raw VoIP files extracted from voipDetector
Ratings & Comments
1 Comment
This tool sdaved me a big time in troubleshooting a routing problem at a customer