Tranalyzer - Tranalyzer2 Cheatsheet

Tutorial: Tranalyzer2 Cheatsheet

List of Tranalyzer2 scripts and utilities
List of Tranalyzer2 navigation shortcuts
t2conf: Configuring Tranalyzer2 and the Plugins
t2build: Building Tranalyzer2 and the Plugins
t2/st2: Running Tranalyzer2
Post-processing
- protStat
- tawk
- t2plot
- t2whois

This cheatsheet summarises the most important scripts and commands used and discussed in the various tutorials.

List of Tranalyzer2 scripts and utilities

`t2`	run Tranalyzer
`st2`	run Tranalyzer as root (sudo)
`gt2`	run Tranalyzer in the `gdb` debugger
`t2build`	build (load/unload) plugins	[Tutorial]
`t2conf`	configure plugins	[Tutorial]
`t2doc`	access plugin documentation
`t2b2t`	convert T2 binary file to text or json
`t2fm`	generate a PDF report from a PCAP file	[Tutorial]
`t2plot`	2D/3D plot	[Tutorial]
`t2stat`	send signals (interrupts) to Tranalyzer2	[Tutorial]
`t2timeline`	generate a timeline from a flow file	[Tutorial]
`t2whois`	query the anteaters subnetfile	[Tutorial]
`protStat`	sort and manipulate protocol statistics files	[Tutorial]
`tawk`	`awk` for Tranalyzer flow and packet files	[Tutorial]

For more details about a specific command, use the script -h or --help option.

`$T2HOME`	tranalyzer root folder
`$T2PLHOME`	tranalyzer plugin root folder
`tran`	go to tranalyzer root folder
`tranpl`	go to tranalyzer plugin root folder
`pluginName`	go to tranalyzer pluginName root folder
`.tran`	go to tranalyzer active plugin folder (`~/.tranalyzer/plugins`)

t2conf: Configuring Tranalyzer2 and the Plugins

To change the value of a configuration flag run:
```
$ t2conf pluginName -D FLAG_NAME=new_value
```
To check the value of a configuration flag run:
```
$ t2conf pluginName -G FLAG_NAME
```
For more details about t2conf, run:
```
$ t2conf --help
```
For an in-depth discussion about t2conf, refer to the Configuration kung fu tutorial.

t2build: Building Tranalyzer2 and the Plugins

Build the default plugins:
```
$ t2build
```
Build specific plugins:
```
$ t2build pluginName1 pluginName2
```
Build everything:
```
$ t2build -a
```
Rebuild Tranalyzer2 and the current plugins:
```
$ t2build -R
```
Unload (deactivate) a plugin:
```
$ t2build -u pluginName
```
List the plugins in the plugin folder:
```
$ t2build -l
```
Empty the plugin folder:
```
$ t2build -e
```
For more details about t2build, run:
```
$ t2build --help
```
For an in-depth discussion about t2build, refer to the Building kung fu tutorial.

t2/st2: Running Tranalyzer2

Analyze a pcap:
```
$ t2 -r file.pcap
```
Change the output prefix:
```
$ t2 -r file.pcap -w /path/prefix
```
Save the final report in a file:
```
$ t2 -r file.pcap -l
```
Analyze traffic (as root) from an interface:
```
$ st2 -i eth0
```
For more details about t2, run:
```
$ t2 --help
```

Post-processing

protStat

The protStat script can be used to sort, filter and manipulate one of the files generated by one of those plugins:

protoStats: _protocols.txt
icmpDecode: _icmpStats.txt
igmpDecode: _igmpStats.txt
nDPI: _nDPI.txt
Sort a file by packets:
```
$ protStat file.txt
```
Sort a file by bytes:
```
$ protStat -b file.txt
```
Sort in reverse order:
```
$ protStat -r file.txt
```
Only display values with packet probability greater than 50%:
```
$ protStat -p 50 file.txt
```
Only display values with byte probability smaller than 1%:
```
$ protStat -b -p -1 file.txt
```
Only display the 5 values with highest byte count:
```
$ protStat -b -n 5 file.txt
```
Only display the 10 values with lowest packet count:
```
$ protStat -n -10 file.txt
```
For more details about protStat, run:
```
$ protStat --help
```

tawk

Decode Tranalyzer status bitfield

$ tawk -V name
...
$ tawk -V name=value
...

List the column names and numbers of a flow file:
```
$ tawk -l file_flows.txt
```
List the functions provided by tawk:
```
$ tawk -g
```
Alternatively, refer to the Alphabetical List of TAWK Functions.
Access the documentation of a tawk function:
```
$ tawk -d name
```
For more details about tawk, run:
```
$ tawk --help
```

For an in-depth discussion about tawk, refer to the Post processing with TAWK tutorial.

t2plot

Basic histograms:

$ t2plot -D file_with_one_columns.txt
...
$ tawk '{ print $col1 }' file_with_many_columns.txt | t2plot -D
...
$ t2plot -D -o colName file_with_many_columns.txt
...
$ t2plot -D -o colNumber file_with_many_columns.txt

Basic 2D plots:

$ t2plot file_with_two_columns.txt
...
$ tawk '{ print $col1, $col2 }' file_with_many_columns.txt | t2plot
...
$ t2plot -D -o colName1:colName2 file_with_many_columns.txt
...
$ t2plot -D -o colNumber1:colNumber2 file_with_many_columns.txt

Basic 3D plots:

$ t2plot file_with_three_columns.txt
...
$ tawk '{ print $col1, $col2, $col3 }' file_with_many_columns.txt | t2plot
...
$ t2plot -D -o colName1:colName2:colName3 file_with_many_columns.txt
...
$ t2plot -D -o colNumber1:colNumber2:colNumber3 file_with_many_columns.txt

Reducing X-, Y- or Z- range:

t2plot -sx lowestValueX:highestValueX -sy lowestValueY:highestValueY -sz lowestValueZ:highestValueZ ...

For more examples with t2plot, run:
```
$ t2plot -e
```
For more details about t2plot, run:
```
$ t2plot --help
```

t2whois

t2whois can be used to query basicFlow geolocation database.

Query one or more IP addresses:
```
$ t2whois 127.0.0.1 ::1
```

Query IP addresses from file:

$ head file.txt
1.2.3.4
5.6.7.8
$ t2whois -r file.txt

Query IP addresses from a file and output the results as one tab separated line:

$ tawk -H '{ print $srcIP "\n" print $dstIP }' file_flows.txt | sort -u | t2whois -l

Only output specific fields:
```
$ t2whois -o netmask,who 1.2.3.4
```
List the fields available:
```
$ t2whois -L
```
Enter the interactive (prompt) mode:
```
$ t2whois
```
Generate a KML file which can be loaded in, e.g., Google Earth or Google Maps:
```
$ tawk '{ print $dstIP }' file_flows.txt | sort -u | t2whois -k file.kml
```
Get information about the databases:
```
$ t2whois -V
```
For more details about t2whois, run:
```
$ t2whois -h
```

For an in-depth discussion about t2whois, refer to the Geolocation and WHOIS behind it tutorial.