Tranalyzer2 is a lightweight flow generator and packet analyzer designed for simplicity, performance and scalability. The program is written in C and built upon the libpcap library. It provides functionality to pre- and post-process IPv4/IPv6 data into flows and enables a trained user to see anomalies and network defects even in very large datasets. It supports analysis with special bit coded fields and generates statistics from key parameters of IPv4/IPv6 Tcpdump traces either being live-captured from an Ethernet interface or one or several pcap files. The quantity of binary and text based output of Tranalyzer2 depends on enabled modules, herein denoted as plugins Hence, users have the possibility to tailor the output according to their needs and developers can develop additional plugins independent of the functionality of other plugins.
Tranalyzer can be downloaded from: https://tranalyzer.com/downloads.html
Tranalyzer2 requires automake, libpcap and libtool:
sudo apt-get install automake libpcap-dev libtool make zlib1g-dev
sudo pacman -S automake libpcap libtool zlib
- Fedora/Red Hat/CentOS:
sudo yum install automake libpcap libpcap-devel libtool zlib-devel bzip2
sudo emerge autoconf automake libpcap libtool zlib
sudo zypper install automake gcc libpcap-devel libtool zlib-devel
- Mac OS X (Brew is a packet manager for Mac OS X that can be found here):
brew install autoconf automake libpcap libtool zlib
To build Tranalyzer2 and the plugins, run one of the following commands:
- Tranalyzer2 only:
cd "$T2HOME"; ./autogen.sh tranalyzer2
cd "$T2HOME/tranalyzer2"; ./autogen.sh)
- A specific plugin only, e.g., myPlugin:
cd "$T2HOME"; ./autogen.sh myPlugin
- (alternative 1:
cd "$T2PLHOME/myPlugin"; ./autogen.sh)
- (alternative 2:
cd "$T2HOME/plugins/myPlugin"; ./autogen.sh)
- Tranalyzer2 and a default set of plugins:
cd "$T2HOME"; ./autogen.sh
- Tranalyzer2 and all the plugins in
cd "$T2HOME"; ./autogen.sh -a
- Tranalyzer2 and a custom set of plugins (listed in plugins.build):
cd "$T2HOME"; ./autogen.sh -b
T2HOME points to the root folder of Tranalyzer, i.e., where the file README.md is located.
For finer control of which plugins to load, refer to Tranalyzer2 documentation.
Note that if t2_aliases is installed, the
t2build command can be used instead of
autogen.sh. The command can be run from anywhere, so just replace the above commands with
t2build --help for the full list of options accepted by the script.
-b option of the
autogen.sh script takes an optional file name as argument. If none is provided, then the default
plugins.build is used. The format of the file is as follows:
- Empty lines and lines starting with a
#are ignored (can be used to prevent a plugin from being built)
- One plugin name per row
# Do not build the tcpStates plugin #tcpStates # Build the txtSink plugin txtSink
A plugins.ignore file can also be used to prevent specific plugins from being built. A different filename can be used with the
-i option of the
autogen.sh script installs Tranalyzer in /usr/local/bin (as
tranalyzer) and the man page in /usr/local/man/man1. Note that root rights are required for the installation.
Alternatively, use the file t2_aliases or add the following alias to your ~/.bash_aliases:
$T2HOME points to the root folder of Tranalyzer, i.e., where the file README.md is located.
The man page can also be installed manually, by calling (as root):
mkdir -p /usr/local/man/man1 && gzip -c man/tranalyzer.1 > /usr/local/man/man1/tranalyzer.1.gz
The file t2_aliases documented in
$T2HOME/scripts/doc/scripts.pdf contains a set of aliases and functions to facilitate working with Tranalyzer. To install it, append the following code to
~/.bash_aliases (make sure to replace
$T2HOME with the actual path, e.g.,
if [ -f "$T2HOME/scripts/t2_aliases" ]; then . "$T2HOME/scripts/t2_aliases" # Note the leading `.' fi
Run Tranalyzer as follows:
tranalyzer -r file.pcap -w outfolder/outprefix
For a full list of options, use Tranalyzer
tranalyzer -h or refer to the complete documentation.
Tranalyzer and every plugin come with their own documentation, which can be found in the doc subfolder. The complete documentation of Tranalyzer2 and all the locally available plugins can be generated by running
$T2HOME/doc. The file t2_aliases provides the function
t2doc to allow easy access to the different parts of the documentation from anywhere.
If the man page was installed, then accessing the man page is as simple as calling
man tranalyzer. If it was not installed, then the man page can be invoked by calling
For a full list of options, use Tranalyzer
A list of frequently asked questions can be found here.
Any feedback, feature requests and questions are welcome and can be sent to the development team via email at tranalyzer at rdit dot ch