NetSniff is a multi-network-layered real-time traffic capture and analysis tool developed as part of the ICE 3 project being run out of the Center for Advanced Internet Architectures (CAIA). NetSniff uses the PCAP library [11] to capture network traffic on a network interface or from a tcpdump [11] formatted file and parses the captured traffic at multiple network layers to produce a detailed set of statistics. Logfileparser is a complementary tool creating a database and filling it with the data captured by NetSniff. This database file can then be queried to obtain relevant statistics and generate graphical results using the R [7] software.

This paper describes the procedures involved to install over a FreeBSD machine all software required to generate these results, as well as provide a brief tutorial in the usage of both lofileparser and R. The first section describes the installation and basic use of NetSniff. Section two outlines the installation of logfileparser and how to generate a database from the logfiles created by NetSniff, while Section 3 covers the installation and usage of R to generate graphical results.

Download pdf Analyzing IP Traffic Captured by Netsniff