How to analyze captured network traffic?

Question

I have some network traffic in the following format:

I am trying to determine if there are any known attacks in this traffic. For this, I was looking at some intrusion detection systems. It looks like both Snort and Bro require the dump to be pcap file for further offline analysis. I looked up the documentation of both systems in detail but could not find any options of handling the data that I have.

Any suggestions on how to perform this analysis? Specifically, I am looking for one of the following:

Some pointers on how to directly use the systems to analyze this data in plain text
Tool to convert this data into a PCAP file that I can later use with the systems

@RobertHarvey: No. I'm not looking for an implementation but rather a methodology to achieve this (if it is possible that is). — Legend, Jan 23 '14 at 18:11
Your question is under-specified. I can't tell if you're looking for an analysis algorithm, a parsing algorithm, or a way to convert the data to pcap so that those programs can handle it. — Robert Harvey, Jan 23 '14 at 18:13
@RobertHarvey: Just updated my question. Let me know if it I need to add other clarification. Thanks! — Legend, Jan 23 '14 at 18:19
I reopened, but I'm still not sure how this is related to software development. — Robert Harvey, Jan 23 '14 at 18:20
What format is it that you have there, exactly? ASCII? When you say "Payload", is that the payload of one packet or of an entire stream? — David Hoelzer, May 19 '16 at 16:01

score 2 · Answer 1 · answered May 21 '14 at 19:36

2

Have you looked into Security Onion? This does exactly what you are looking for (the flow data you are looking for (with argus or Bro) and let's you pivot to the pcaps from those flows.

answered May 21 '14 at 19:36

punkrokk

46
5

score 2 · Answer 2 · answered Aug 21 '15 at 12:54

Bro provides a framework called Input Framework to "input data into bro".

You can specify which values should be read, what separator should be used and so on (options-reference). The input framework gives you the ability to read such ASCII files or use different readers (benchmark, binary, raw, sqlite).

You can for example use the RawReader to execute shell commands to convert the file or to send the result (stdout) to an event.

How to analyze captured network traffic?

2 Answers2