Tutorial: Monitoring/Reporting

Description

This tutorial details the use of the monitoring mode of the Anteater, which works independently of the flow or packet information production.

It was originally used to give the user an intermittent report and thus a decision base if large pcaps in the Tbyte regime were processed. Then it evolved into remote controlled and autonomous multi-sensor reporting and monitoring where an admin once configures T2 and deploys it on a machine listening on an interface. In this tutorial we will discuss all aspects of T2 reporting.

Preparation

In order to do so, we need to prepare T2. If you did not complete the tutorials before, just follow the procedure described below.

First, restore T2 into a pristine state by removing all unnecessary or older plugins from the plugin folder ~/.tranalyzer/plugins and compile only basicFlow, basicStats, tcpStates, ftpDecode and txtSink.

$ t2build -e
Are you sure you want to empty the plugin folder '/home/wurst/.tranalyzer/plugins' (y/N)? y
Plugin folder emptied
$ t2build basicFlow basicStats tcpStates ftpDecode txtSink
...
BUILD SUCCESSFUL

The -e option for t2build also leads to the subnet file for geolocation being regenerated when building basicFlow the next time, which can take a bit of time.

An alternative would be to just remove the .so files, and preserve the old subnetfiles:

$ rm ~/.tranalyzer/plugins/*.so
$ t2build basicFlow basicStats tcpStates txtSink

Then the compilation will be a bit faster, as the subnetfile already exists. If you did not create a separate data and results directory yet, please do it now in another cmd window, that facilitates your workflow:

$ mkdir ~/data
$ mkdir ~/results
$ cd data

The anonymized sample PCAP being used here, can be downloaded here: faf-exercise.pcap. Please extract it under your data folder. Sniffing directly from the interface is required, so have your sudo PW ready. Now you are all set for T2 monitoring experiments.

Signalling and remote control of the Anteater

The Anteater can be remote controlled, using UNIX signals. The basic ones are listed below:

Signal Description
SIGUSR1 invoke one intermittent report
SIGUSR2 start/stop periodical reports: Monitoring Mode
SIGINT stop flow creation (like ^C in the shell)
SIGTERM terminate T2 immmediately (Like 2 * ^C)

Have two bash windows open. One where you start T2, and another one where control signals can be sent from. Start T2 on your interface. If you do not know the name use ifconfig or ip link and use the -i option.

Note, sudo is required to gain access to the interface. Because your tranalyzer binary was built under your account, the -p option is required. It tells T2 where to find its plugins, in our case in the wurst user home directory. Just swap it with your home directory. To make life simpler for you, benoit added a st2 command for you for such purposes, so you have no hassle with the sudo and that there are normally no aliases defined under your root account. It also takes care of the location of your plugin directory, hence the parameter: -p /home/wurst/.tranalyzer/plugins/ can be omitted.

Now switch to the other bash window and invoke the USR1 command. The command t2stat has the same effect.

or repetitive on/off

or you use the t2stat command, which does not require a PID:

$ t2stat -h
Usage:
    t2stat [OPTION...] [INTERVAL]

Optional arguments:
    INTERVAL     Send a signal to Tranalyzer every INTERVAL seconds
    -SIGNAME     Send SIGNAME signal instead of a USR1
    -s           Run the command as root (with sudo)
    -p           Print Tranalyzer PID and exit
    -h           Show help options and exit
$ t2stat -s -USR2
[sudo] password for wurst:
$

You will then see the following output in the T2 window something like this, if you once invoked a t2stat. If you used the USR2 command, or t2stat -s -2, every second an intermittent anteater report will be printed until you send another USR2 signal.

...
                                    @      @                                    
                                     |    |                                     
===============================vVv==(a    a)==vVv===============================
=====================================\    /=====================================
======================================\  /======================================
                                       oo                                       
USR1 A type report: Tranalyzer 0.8.2 (Anteater), Tarantula. PID: 26789
PCAP time: 1549024095.109584 sec (Fri 01 Feb 2019 12:28:15 GMT)
PCAP duration: 48.432348 sec
Time: 1549024095.489609 sec (Fri 01 Feb 2019 13:28:15 CET)
Elapsed time: 48.724560 sec
Number of packets received: 256 [100.00%]
Number of processed packets: 255
Number of processed bytes: 72085 (72.08 K)
Number of raw bytes: 72085 (72.08 K)
Number of IPv4 packets: 164 [64.31%]
Number of IPv6 packets: 31 [12.16%]
Number of A packets: 182 [71.37%]
Number of B packets: 73 [28.63%]
Number of A bytes: 34028 (34.03 K) [47.21%]
Number of B bytes: 38057 (38.06 K) [52.79%]
Average A packet load: 186.97
Average B packet load: 521.33
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Headers count: min: 2, max: 4, average: 2.94
Number of LLC packets: 24 [9.41%]
Number of ICMPv6 packets: 21 [8.24%]
Number of TCP packets: 133 [52.16%]
Number of UDP packets: 21 [8.24%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 21
Number of processed A flows: 18 [85.71%]
Number of processed B flows: 3 [14.29%]
Number of request     flows: 18 [85.71%]
Number of reply       flows: 3 [14.29%]
Total   A/B    flow asymmetry: 0.71
Total req/rply flow asymmetry: 0.71
Number of processed   packets/flows: 12.14
Number of processed A packets/flows: 10.11
Number of processed B packets/flows: 24.33
Number of processed total packets/s: 5.27
Number of processed A+B packets/s: 5.27
Number of processed A   packets/s: 3.76
Number of processed   B packets/s: 1.51
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 0.43
Average full raw bandwidth: 11907 b/s (11.91 Kb/s)
Average full bandwidth : 10990 b/s (10.99 Kb/s)
Fill size of main hash map: 21 [0.01%]
Max number of flows in memory: 21 [0.01%]
Memory usage: 0.35 GB [0.53%]
Aggregate flow status: 0x010010000200c064
[INF] IPv4
[INF] IPv6
[INF] SSDP/UPnP flows
[INF] Ethernet flows
[INF] LLDP flows
[INF] ARP flows
[INF] TOR addresses
================================================================================

Note at the beginning USR1 A Type denotes that there was a signal received and all reporting is aggregated _A from the beginning of T2 operation, almost like the end report. There is also a differential mode, s. next section.

As this output is not really convenient for scripting and postprocessing tools, we introduced the machine mode, which we will also discuss in the next section

Activation of machine Monitoring / Reporting Mode

In order to configure the more script friendly machine representation open the file tranalyzer.h under ~/tranalyzer2/trunk/tranlyzer2/src and skip to the End report section as printed below in the default configuration:

To switch from reporting to machine compliant reporting set MACHINE_REPORT 1. The monitoring output is by default aggregated over time, like the end report. Switch also to the differential output mode, which is mostly used by reporting tools, such as RRD Tool. Then, the counts and changes are sampled in a certain time period, by default 1s. So set DIFF_REPORT 1. The PLUGIN_REPORT enables the monitoring output in the plugins. We leave it on. If you switch it off you need to recompile with t2build -R because code has to be removed from the plugins.

Now save the file and recompile only t2:

and execute the line of the last section and trigger t2stats then you will see the following output, which looks now more script friendly.

$ st2 -i yourinterface -w ~/results/ 
================================================================================
Tranalyzer 0.8.2 (Anteater), Tarantula. PID: 28205
================================================================================
[INF] Creating flows for L2, IPv4, IPv6
Active plugins:
    01: basicFlow, 0.8.3
    02: basicStats, 0.8.3
    03: tcpStates, 0.8.2
    04: ftpDecode, 0.8.2
    05: txtSink, 0.8.2
[INF] basicFlow: IPv4 Ver: 3, Rev: 20190114, Range Mode: 0, subnet ranges loaded: 2816218 (2.82 M)
[INF] basicFlow: IPv6 Ver: 3, Rev: 20190114, Range Mode: 0, subnet ranges loaded: 36634 (36.63 K)
Live capture on interface: enp11s0
Link layer type: Ethernet [EN10MB/1]
%repTyp	time	dur	pktsRec	pktsDrp	ifDrp	memUsageKB	fillSzHashMap	numFlows	numAFlows	numBFlows	numPkts	numAPkts	numBPkts	numV4Pkts	numV6Pkts	numVxPktsnumBytes	numABytes	numBBytes	numFrgV4Pkts	numFrgV6Pkts	numAlarms	rawBandwidth	globalWarn	0x0042	0x00fe	0x0806	0x8035	0x0800	0x86dd	ICMP	IGMP	TCP	UDP	GRE	ICMPv6	SCTP	ftpPkts	
Dump start: 1549024811.281412 sec (Fri 01 Feb 2019 12:40:11 GMT)
Dump start: 1549024881.167858 sec (Fri 01 Feb 2019 12:41:21 GMT)
USR1MR_D	1549024885.737630	4.569772	33	0	0	354228	23	23	21	2	32	29	3	12	13	0	3395	3197	198	0	0	05.943	0x010000000000c044	3	0	4	0	12	13	0	2	8	1	0	12	0	0	
USR1MR_D	1549024886.363113	0.625483	34	0	0	0	0	0	0	0	1	1	0	0	1	0	130	130	0	0	0	01.663	0x010000000000c044	0	0	0	0	0	1	0	0	0	0	0	1	0	0	
USR1MR_D	1549024888.128874	1.765761	58	0	0	0	0	0	0	0	15	8	7	12	1	0	5376	2771	2605	0	0	024.357	0x010000000000c044	1	0	1	0	12	1	0	0	12	0	0	1	0	0	
USR1MR_D	1549024888.852933	0.724059	65	0	0	0	0	0	0	0	11	5	6	10	0	0	7062	1410	5652	0	0	078.027	0x010000000000c044	0	0	1	0	10	0	0	0	10	0	0	0	0	0	
USR1MR_D	1549024889.854888	1.001955	71	0	0	0	4	4	2	2	12	9	3	9	1	0	944	746	198	0	0	07.537	0x010000000000c044	1	0	1	0	9	1	0	0	8	0	0	0	0	0	
USR1MR_D	1549024891.015390	1.160502	74	0	0	0	2	2	1	1	3	2	1	2	0	0	192	126	66	0	0	01.324	0x010000000000c044	0	0	1	0	2	0	0	0	2	0	0	0	0	0	
USR1MR_D	1549024891.858805	0.843415	76	0	0	0	0	0	0	0	2	2	0	0	0	0	179	179	0	0	0	01.698	0x010000000000c044	1	0	1	0	0	0	0	0	0	0	0	0	0	0	
i[INF] SIGINT: Stop flow creation: 0x0002
[INF] SIGINT: Stop flow creation: 0x0001
Dump stop : 1549025124.223478 sec (Fri 01 Feb 2019 12:45:24 GMT)
Total dump duration: 243.055620 sec (4m 3s)
Finished processing. Elapsed time: 243.598215 sec (4m 3s)
Finished unloading flow memory. Time: 243.600645 sec (4m 3s)
Number of packets received: 1635 (1.64 K) [100.00%]
Number of processed packets: 1634 (1.63 K)
Number of processed bytes: 381195 (381.19 K)
Number of raw bytes: 381195 (381.19 K)
Number of IPv4 packets: 999 [61.14%]
Number of IPv6 packets: 304 [18.60%]
Number of A packets: 1249 (1.25 K) [76.44%]
Number of B packets: 385 [23.56%]
Number of A bytes: 213754 (213.75 K) [56.07%]
Number of B bytes: 167441 (167.44 K) [43.93%]
Average A packet load: 171.14
Average B packet load: 434.91
--------------------------------------------------------------------------------
basicStats: Biggest Talker: x.y.y.u: 271 [16.59%] packets
basicStats: Biggest Talker: x.y.z.u: 125936 (125.94 K) [33.04%] bytes
tcpStates: Aggregated anomaly flags: 0x53
ftpDecode: Anomaly flags: 0x00
--------------------------------------------------------------------------------
Headers count: min: 2, max: 4, average: 2.99
Number of LLC packets: 122 [7.47%]
Number of IGMP packets: 27 [1.65%]
Number of ICMPv6 packets: 163 [9.98%]
Number of TCP packets: 698 [42.72%]
Number of UDP packets: 319 [19.52%]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of processed   flows: 146
Number of processed A flows: 126 [86.30%]
Number of processed B flows: 20 [13.70%]
Number of request     flows: 125 [85.62%]
Number of reply       flows: 21 [14.38%]
Total   A/B    flow asymmetry: 0.73
Total req/rply flow asymmetry: 0.71
Number of processed   packets/flows: 11.19
Number of processed A packets/flows: 9.91
Number of processed B packets/flows: 19.25
Number of processed total packets/s: 6.72
Number of processed A+B packets/s: 6.72
Number of processed A   packets/s: 5.14
Number of processed   B packets/s: 1.58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Number of average processed flows/s: 0.60
Average full raw bandwidth: 12547 b/s (12.55 Kb/s)
Average full bandwidth : 11579 b/s (11.58 Kb/s)
Max number of flows in memory: 129 [0.05%]
Memory usage: 0.36 GB [0.53%]
Aggregate flow status: 0x010010000200c064
[WRN] Consecutive duplicate IP ID
[INF] IPv4
[INF] IPv6
[INF] SSDP/UPnP flows
[INF] Ethernet flows
[INF] LLDP flows
[INF] ARP flows
[INF] TOR addresses
$

Use t2stat -s -USR2 to switch monitoring on and off. Note, the USR1MR_D, which denotes signal received, differential reporting. Nevertheless, the output of the header and End report including all warnings are not beneficial if we want to postprocess the stream. So open tranalyzer.h again look for verbose level

If you switch to VERBOSE 0, you have to recompile all plugins with t2build -R, because all plugins have also a VERBOSE switch dependend code base. Now T2 and all plugins are mute. This option is good if you once compile T2 to do a job in a network, but if you are more the research like guy the -l option is a much better choice. It reroutes all the endreporting into a file yourinterface_log.txt.

Execute the st2 command line again and trigger some USR1 or USR2 signals then you will see the following output, which is more script friendly. Same signal sequence was used as above.

$ st2 -i yourinterface -w ~/results/ -l
%repTyp   time               dur        pktsRec  pktsDrp  ifDrp  memUsageKB  fillSzHashMap  numFlows  numAFlows  numBFlows  numPkts  numAPkts  numBPkts  numV4Pkts  numV6Pkts  numVxPkts  numBytes  numABytes  numBBytes  numFrgV4Pkts  numFrgV6Pkts  numAlarms  rawBandwidth  globalWarn          0x0042  0x00fe  0x0806  0x8035  0x0800  0x86dd  ICMP  IGMP  TCP  UDP  GRE  ICMPv6  SCTP  ftpPkts
USR1MR_D  1549201831.695905  11.019974  116      0        0      415420      18             18        11         7          94       53        41        78         2          0          25794     11195      14599      0             0             0          18.725        0x010000000000c044  6       0       8       0       78      2       0     0     74   2    0    0       0     0
USR1MR_D  1549201833.695828  1.999923   120      0        0      0           3              3         2          1          23       13        10        22         0          0          4242      2950       1292       0             0             0          16.969        0x010000000200c044  1       0       0       0       22      0       0     0     21   1    0    0       0     0
USR1MR_D  1549201834.695494  0.999666   124      0        0      144         2              2         1          1          4        3         1         3          0          0          449       359        90         0             0             0          3.593         0x010000000200c044  0       0       1       0       3       0       0     0     0    3    0    0       0     0
USR1MR_D  1549201835.697315  1.001821   131      0        0      0           3              3         3          0          8        8         0         2          4          0          934       934        0          0             0             0          7.458         0x010010000200c044  1       0       1       0       2       4       0     0     0    1    0    3       0     0
USR1MR_D  1549201836.699285  1.001970   139      0        0      0           0              0         0          0          5        4         1         3          1          0          531       465        66         0             0             0          4.240         0x010010000200c044  0       0       1       0       3       1       0     0     2    1    0    1       0     0
USR1MR_D  1549201837.734302  1.035017   276      0        0      0           8              8         4          4          116      49        67        114        0          0          123166    4698       118468     0             0             0          951.992       0x010010000200c044  1       0       1       0       114     0       0     0     108  6    0    0       0     0
USR1MR_D  1549201838.703226  0.968924   277      0        0      0           1              1         1          0          27       11        16        24         1          0          25717     1052       24665      0             0             0          212.335       0x010010000200c064  0       0       1       0       24      1       0     0     24   0    0    1       0     0
USR1MR_D  1549201839.709350  1.006124   281      0        0      0           0              0         0          0          3        3         0         1          0          0          245       245        0          0             0             0          1.948         0x010010000200c064  1       0       1       0       1       0       0     0     1    0    0    0       0     0
...

So you will not see the PID, because all end reporting is switched off. In order to acquire the PID of T2 use the following commands:

and issue the repetetive on/off signal to T2, using a bit of bash kungfu:

or just use t2stat

Now all end reports from T2 and the plugins are routed into the log file. T2 still produces flow and other plugin related files to your results directory. If you are only interested in the monitoring output unload txtSink and T2 becomes more perfomant on the monitoring task, because the flow write process to the disk is omitted. And you do not need to supply the -w option anymore.

You can also use the BLOCKBUF switch in tranalyzer.h, disabling all flow output generation, making T2 even faster, which we will discuss later. For the time being we are good so far.

If you were only interested in remote controlling the T2 monitoring process, you have your wish now. Nevertheless, in case of pcap processing, or time series generation for research purposes we need to talk about time bases and other nitty gritty functionality of the Anteater.

Timebase, pcaps and stuff

Open main.h under trunk/tranalyzer/src and skip to the Monitoring mode section; it looks a bit confusing, but it combines several different operations. Don’t worry I’ll talk you through.

The first two constants MONINTTHRD, MONINTBLK control the monitoring and reporting process, either via a thread or integrated into the cores main loop.

These modes were introduced, because the libPCAP showed instabilities on certain platforms in the past if unix signal are involved, when operating on an interface. These bugs are fixed by the libPcap crew, so the BLK mode is not needed anymore. If you do not like trheading, you can switch to INTBLK mode. The rest of the earth’s population can stick with the default setting.

The next MONINTPSYNC controles the location of the print operation, either in the signal interrupt routine or synchronized to the packet processing at main loop level. If you sniff on an interface which has almost no traffic, but you require every 1 sec a report, then set MONINTPSYNC 0. Otherwise, leave it at 1 because then the packet processing is always priortized and thus more performant. So default setting is good for us.

The constant MONINTTMPCP defines the time base of the monitoring process; either pcap time, or real time. If you read from a pcap, which may consist of many days of packet capture, you can simulate a monitoring signal, if MONINTTMPCP **1**. On an interface T2 will then also produce a stream of monitoring output because the pcap time is then the real time. So let’s set MONINTTMPCP **1**, pcap time rules.

If in realtime base MONINTTMPCP_ON defines whether T2 starts monitoring right at startup or waits for a USR1 or USR2 signal. Will be discussed later.

MONINTV denotes the default monitoring interval in seconds. Let’s set it to 10, so that we do not produce so much output from our test pcap: faf-exercise.pcap.

The Monitoring mode protocol stat section denotes the protocols T2 outputs. MONPROTMD defines the type of header output, ether protocol numbers or the human readable names, which is the default. If you like to write your own postprocessing, protocol numbers might be better a better choice. MONPROTL2 / MONPROTL3 define the protocols, which should be monitored. Later we will add some more. For the time being we leave everything as default for the time being. Note, that every plugin can contribute to the monitoring mode, as in the endreport. So loading new plugins might produce new columns.

So summarizing the config we need to make: We switch to pcap based, and set the timing interval to 10s. So it has to look like this.

Now close the file and recompile T2:

And apply t2 to the pcap you downloaded before. As we produce no flows anymore, the -w option can be omitted, and we do not need to be root anymore because we operate now on our test pcap.

$ t2 -r ~/data/faf-exercise.pcap -l
%repTyp   time               dur           memUsageKB  fillSzHashMap  numFlows  numAFlows  numBFlows  numPkts  numAPkts  numBPkts  numV4Pkts  numV6Pkts  numVxPkts  numBytes  numABytes  numBBytes  numFrgV4Pkts  numFrgV6Pkts  numAlarms  rawBandwidth  globalWarn          0x0042  0x00fe  0x0806  0x8035  0x0800  0x86dd  ICMP  IGMP  TCP   UDP  GRE  ICMPv6  SCTP  ftpPkts
USR1MR_D  1258562467.749142  18252.711932  413280      1              19        10         9          200      66        134       200        0          0          153213    7121       146092     0             0             0          0.067         0x0000000000004000  0       0       0       0       200     0       0     0     200   0    0    0       0     0
USR1MR_D  1258562477.713894  9.964752      0           1              1         0          1          7        4         3         7          0          0          1762      1148       614        0             0             0          1.415         0x0000000000004000  0       0       0       0       7       0       0     0     7     0    0    0       0     0
USR1MR_D  1258562501.432305  23.718411     0           2              2         1          1          32       12        20        32         0          0          22559     2125       20434      0             0             0          7.609         0x0000000000004000  0       0       0       0       32      0       0     0     32    0    0    0       0     0
USR1MR_D  1258563573.941668  1072.509363   96          -3             1         1          0          8        5         3         8          0          0          484       322        162        0             0             0          0.004         0x0000000000004000  0       0       0       0       8       0       0     0     8     0    0    0       0     0
USR1MR_D  1258565030.304653  1456.362985   0           0              2         1          1          49       19        30        49         0          0          7145      4077       3068       0             0             0          0.039         0x0000000000004000  0       0       0       0       49      0       0     0     49    0    0    0       0     0
USR1MR_D  1258565174.919134  144.614481    0           0              2         1          1          49       19        30        49         0          0          9840      6807       3033       0             0             0          0.544         0x0000000000004000  0       0       0       0       49      0       0     0     49    0    0    0       0     0
USR1MR_D  1258565820.302090  645.382956    0           0              2         1          1          45       17        28        45         0          0          6298      3373       2925       0             0             0          0.078         0x0000000000004000  0       0       0       0       45      0       0     0     45    0    0    0       0     0
USR1MR_D  1258565880.189257  59.887167     0           0              2         1          1          47       18        29        47         0          0          9076      5979       3097       0             0             0          1.212         0x0000000000004000  0       0       0       0       47      0       0     0     47    0    0    0       0     0
USR1MR_D  1258566050.124592  169.935335    0           0              2         1          1          48       18        30        48         0          0          7934      5503       2431       0             0             0          0.374         0x0000000000004000  0       0       0       0       48      0       0     0     48    0    0    0       0     0
USR1MR_D  1258566123.706408  73.581816     0           0              2         1          1          43       16        27        43         0          0          6640      3704       2936       0             0             0          0.722         0x0000000000004000  0       0       0       0       43      0       0     0     43    0    0    0       0     0
USR1MR_D  1258567109.383510  985.677102    0           0              2         1          1          45       17        28        45         0          0          8273      5383       2890       0             0             0          0.067         0x0000000000004000  0       0       0       0       45      0       0     0     45    0    0    0       0     0
USR1MR_D  1258567248.261596  138.878086    0           0              2         1          1          42       16        26        42         0          0          5264      2482       2782       0             0             0          0.303         0x0000000000004000  0       0       0       0       42      0       0     0     42    0    0    0       0     0
USR1MR_D  1258567289.262109  41.000513     96          0              2         1          1          46       18        28        46         0          0          9207      6317       2890       0             0             0          1.796         0x0000000000004000  0       0       0       0       46      0       0     0     46    0    0    0       0     0
USR1MR_D  1258567757.457759  468.195650    0           0              2         1          1          47       19        28        47         0          0          9080      6928       2152       0             0             0          0.155         0x0000000000004000  0       0       0       0       47      0       0     0     47    0    0    0       0     0
USR1MR_D  1258568036.508358  279.050599    0           0              2         1          1          43       16        27        43         0          0          6324      3388       2936       0             0             0          0.181         0x0000000000004000  0       0       0       0       43      0       0     0     43    0    0    0       0     0
USR1MR_D  1258568059.128662  22.620304     0           0              2         1          1          43       16        27        43         0          0          6352      3416       2936       0             0             0          2.246         0x0000000000004000  0       0       0       0       43      0       0     0     43    0    0    0       0     0
USR1MR_D  1258568667.549041  608.420379    0           0              2         1          1          42       16        26        42         0          0          7108      4326       2782       0             0             0          0.093         0x0000000000004000  0       0       0       0       42      0       0     0     42    0    0    0       0     0
USR1MR_D  1258568738.108255  70.559214     0           0              2         1          1          42       16        26        42         0          0          6114      3332       2782       0             0             0          0.693         0x0000000000004000  0       0       0       0       42      0       0     0     42    0    0    0       0     0
USR1MR_D  1258574141.027462  5402.919207   0           0              2         1          1          45       17        28        45         0          0          8336      5346       2990       0             0             0          0.012         0x0000000000004000  0       0       0       0       45      0       0     0     45    0    0    0       0     0
USR1MR_D  1258577484.692600  3343.665138   0           0              2         1          1          27       10        17        27         0          0          2861      1627       1234       0             0             0          0.007         0x0000000000004000  0       0       0       0       27      0       0     0     27    0    0    0       0     0
USR1MR_D  1258577840.949762  356.257162    0           0              2         1          1          27       10        17        27         0          0          2601      1367       1234       0             0             0          0.058         0x0000000000004000  0       0       0       0       27      0       0     0     27    0    0    0       0     0
USR1MR_D  1258581757.587843  3916.638081   0           0              2         1          1          27       10        17        27         0          0          2414      1180       1234       0             0             0          0.005         0x0000000000004000  0       0       0       0       27      0       0     0     27    0    0    0       0     0
USR1MR_D  1258582107.588230  350.000387    0           0              2         1          1          45       18        27        45         0          0          9638      6802       2836       0             0             0          0.220         0x0000000000004000  0       0       0       0       45      0       0     0     45    0    0    0       0     0
USR1MR_D  1258583614.298059  1506.709829   92          0              2         1          1          43       17        26        43         0          0          7260      4478       2782       0             0             0          0.039         0x0000000000004000  0       0       0       0       43      0       0     0     43    0    0    0       0     0
USR1MR_D  1258587444.865917  3830.567858   0           0              2         1          1          49       20        29        49         0          0          11215     8271       2944       0             0             0          0.023         0x0000000000004000  0       0       0       0       49      0       0     0     49    0    0    0       0     0
USR1MR_D  1258594162.928342  6718.062425   0           0              4         2          2          125      32        93        125        0          0          126429    2679       123750     0             0             0          0.151         0x0000000000004000  0       0       0       0       125     0       0     0     125   0    0    0       0     1
USR1MR_D  1258594172.021456  9.093114      0           3              3         1          2          1449     490       959       1449       0          0          1390416   32782      1357634    0             0             0          1223.269      0x0000000000004000  0       0       0       0       1449    0       0     0     1449  0    0    0       0     18
USR1MR_D  1258594182.050150  10.028694     0           0              0         0          0          2538     812       1726      2538       0          0          2527208   54036      2473172    0             0             0          2015.982      0x0000000000004000  0       0       0       0       2538    0       0     0     2538  0    0    0       0     0
USR1MR_D  1258594491.683288  309.633138    0           -2             0         0          0          649      222       427       649        0          0          622363    15016      607347     0             0             0          16.080        0x0000000000004000  0       0       0       0       649     0       0     0     649   0    0    0       0     3

Note that the timestamp and the duration are not correlating with the configured monitoring interval. What is the reason? Invoke the packet mode using the -s option:

Change to the bash window where you are in the ~/results directory and look into the packet file:

$ tcol faf-exercise_packets.txt
%pktNo  flowInd  flowStat            time               pktIAT      flowDuration  numHdrs  hdrDesc       ethVlanID  srcMac             dstMac             ethType  srcIP           srcIPCC  srcIPWho             srcPort  dstIP           dstIPCC  dstIPWho             dstPort  l4Proto  srcManuf  dstManuf  pktLen  l7Len  l7Content
1       1        0x0000000000004000  1258544215.037210  0.000000    0.000000      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1258     77.67.44.206    es       akamai technologies  80       6        Dell      Apple     66      0      
2       1        0x0000000000004001  1258544215.202900  0.000000    0.000000      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   77.67.44.206    es       akamai technologies  80       192.168.1.104   02       private_reserved     1258     6        Apple     Dell      62      0      
3       1        0x0000000000004000  1258544215.203358  0.166148    0.166148      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1258     77.67.44.206    es       akamai technologies  80       6        Dell      Apple     64      0      
4       1        0x0000000000004000  1258544215.203850  0.000492    0.166640      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1258     77.67.44.206    es       akamai technologies  80       6        Dell      Apple     425     367    GET /softw/90/update/avg9infoavi.ctf HTTP/1.1\r\nUser-Agent: AVGINET9-WXPPX86 90 AVI=270.14.71/2510 BUILD=707 LOC=1033 LIC=9I-ASXNN-X4WGW-M0XFR-T84VX-3VX02 DIAG=51E OPF=0 PCA=\r\nHost: backup.avg.cz\r\nAccept: */*\r\nAccept-Encoding: identity,deflate,gzip\r\nIf-Modified-Since: Tue, 17 Nov 2009 20:41:10 GMT\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nx-avg-id:78-175947826\r\n\r\n
5       1        0x0000000000004001  1258544215.370055  0.167155    0.167155      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   77.67.44.206    es       akamai technologies  80       192.168.1.104   02       private_reserved     1258     6        Apple     Dell      1434    1380   HTTP/1.1 200 OK\r\nDate: Wed, 18 Nov 2009 11:39:48 GMT\r\nServer: Apache\r\nLast-Modified: Wed, 18 Nov 2009 09:04:15 GMT\r\nETag: "15c007-cea-478a186e401c0"\r\nAccept-Ranges: bytes\r\nContent-Length: 3306\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\nAVG CTF Index File;ver(10)\r\nbin(u7avi1777ff.bin)grp(avi:1777)tm(0911180855)pri(2)len(6637487)\r\nbin(u7avi1777u1323ff.bin)grp(avi:1777)dep(avi:1323)tm(0911180855)pri(2)len(590030)\r\nbin(u7avi1777u1705ff.bin)grp(avi:1777)dep(avi:1705)tm(0911180855)pri(2)len(95323)\r\nbin(u7iavi2511ff.bin)grp(iavi:2511)tm(0911180855)pri(2)len(45641416)\r\nbin(u7iavi2511u2251fo.bin)grp(iavi:2511)dep(iavi:2251)tm(0911180855)pri(2)len(6175342)\r\nbin(u7iavi2511u2353fn.bin)grp(iavi:2511)dep(iavi:2353)tm(0911180855)pri(2)len(4506824)\r\nbin(u7iavi2511u2404fm.bin)grp(iavi:2511)dep(iavi:2404)tm(0911180855)pri(2)len(3342546)\r\nbin(u7iavi2511u2431fl.bin)grp(iavi:2511)dep(iavi:2431)tm(0911180855)pri(2)len(2609643)\r\nbin(u7iavi2511u2458fk.bin)grp(iavi:2511)dep(iavi:2458)tm(0911180855)pri(2)len(1380674)\r\nbin(u7iavi2511u2480fj.bin)grp(iavi:2511)dep(iavi:2480)tm(0911180855)pri(2)len(681743)\r\nbin(u7iavi2511u2490fi.bin)grp(iavi:2511)dep(iavi:2490)tm(0911180855)pri(2)len(555496)\r\nbin(u7iavi2511u2500fh.bin)grp(iavi:2511)dep(iavi:2500)tm(0911180855)pri(2)len(332906)\r\nbin(u7iavi2511u2505fh.bin)grp(iavi:2511)dep(iavi:2505)tm(0911180855)pri(2)len(204942)\r\nbin(u7iavi2511u2508
6       1        0x0000000000004001  1258544215.370067  0.000012    0.167167      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   77.67.44.206    es       akamai technologies  80       192.168.1.104   02       private_reserved     1258     6        Apple     Dell      375     321    fg.bin)grp(iavi:2511)dep(iavi:2508)tm(0911180855)pri(2)len(72274)\r\nbin(u7iavi2511u2510ff.bin)grp(iavi:2511)dep(iavi:2510)tm(0911180855)pri(2)len(30540)\r\nbin(u9ichjw4qt.bin)grp(ichjw:4)pri(2)tm(0907131859)len(113488)\r\nbin(u9ichjw4u2ia.bin)grp(ichjw:4)dep(ichjw:2)pri(2)tm(0907131859)len(94470)\r\nbin(u9ichjw4u3gq.bin)grp(ic
7       1        0x0000000000004000  1258544215.370501  0.166651    0.333291      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1258     77.67.44.206    es       akamai technologies  80       6        Dell      Apple     64      0      
8       1        0x0000000000004001  1258544215.370560  0.000493    0.167660      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   77.67.44.206    es       akamai technologies  80       192.168.1.104   02       private_reserved     1258     6        Apple     Dell      1434    1380   hjw:4)dep(ichjw:3)pri(2)tm(0907131859)len(13313)\r\nbin(u9idat249b243tc.bin)grp(idat:249)dif(idat:243)pri(2)tm(0911051401)len(621430)\r\nbin(u9idat249b245bp.bin)grp(idat:249)dif(idat:245)pri(2)tm(0911051401)len(197648)\r\nbin(u9idat249b246mj.bin)grp(idat:249)dif(idat:246)pri(2)tm(0911051400)len(159289)\r\nbin(u9idat249b247uh.bin)grp(idat:249)dif(idat:247)pri(2)tm(0911051400)len(95680)\r\nbin(u9idat249le.bin)grp(idat:249)pri(2)tm(0911051400)len(1927074)\r\nbin(u9ifw42jx.bin)grp(ifw:42)pri(2)tm(0911131400)len(541853)\r\nbin(u9ifw42u38we.bin)grp(ifw:42)dep(ifw:38)pri(2)tm(0911131400)len(123575)\r\nbin(u9ifw42u39ke.bin)grp(ifw:42)dep(ifw:39)pri(2)tm(0911131400)len(92745)\r\nbin(u9ifw42u40dc.bin)grp(ifw:42)dep(ifw:40)pri(2)tm(0911131400)len(67292)\r\nbin(u9ifw42u41tz.bin)grp(ifw:42)dep(ifw:41)pri(2)tm(0911131400)len(18393)\r\nbin(x8all234yc.bin)grp(xplph:0012;xplsb:0099;xplsb2:0118;xplsc:0149)tm(0911180700)pri(2)len(1146352)\r\nbin(x8xplph_12gj.bin)grp(xplph:12)tm(0910280700)pri(2)len(4551)\r\nbin(x8xplsb2_118c8.bin)grp(xplsb2:118)tm(0911180700)pri(2)len(4989)\r\nbin(x8xplsb_9946.bin)grp(xplsb:99)tm(0911160700)pri(2)len(985460)\r\nbin(x8xplsb_99d9546.bin)grp(xplsb:99)dif(xplsb:95)tm(0911160700)pri(2)len(32267)\r\nbin(x8xplsb_99d9646.bin)grp(xplsb:99)dif(xplsb:96)tm(0911160700)pri(2)len(3505)\r\nbin(x8xplsb_99d9746.bin)grp(xplsb:99)dif(xplsb:97)tm(0911160700)pri(2)len(644)\r\nbin(x8xplsb_99d9846.bin
9       1        0x0000000000004001  1258544215.370571  0.000011    0.167671      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   77.67.44.206    es       akamai technologies  80       192.168.1.104   02       private_reserved     1258     6        Apple     Dell      520     466    )grp(xplsb:99)dif(xplsb:98)tm(0911160700)pri(2)len(581)\r\nbin(x8xplsc_149c8.bin)grp(xplsc:149)tm(0911180700)pri(2)len(151922)\r\nbin(x8xplsc_149d145c8.bin)grp(xplsc:149)dif(xplsc:145)tm(0911180700)pri(2)len(2561)\r\nbin(x8xplsc_149d146c8.bin)grp(xplsc:149)dif(xplsc:146)tm(0911180700)pri(2)len(1921)\r\nbin(x8xplsc_149d147c8.bin)grp(xplsc:149)dif(xplsc:147)tm(0911180700)pri(2)len(1767)\r\nbin(x8xplsc_149d148c8.bin)grp(xplsc:149)dif(xplsc:148)tm(0911180700)pri(2)len(1411)\r\n
...
197     9        0x0000000000004001  1258544218.165782  0.009740    0.028239      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   198.189.255.75  us       --                   80       192.168.1.104   02       private_reserved     1266     6        Apple     Dell      54      0      
198     9        0x0000000000004000  1258544218.166240  0.007500    0.035982      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1266     198.189.255.75  us       --                   80       6        Dell      Apple     64      0      
199     8        0x0000000000004001  1258544218.294696  0.167378    0.342534      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   77.67.44.206    es       akamai technologies  80       192.168.1.104   02       private_reserved     1265     6        Apple     Dell      54      0      
200     10       0x0000000000004000  1258562467.749142  0.000000    0.000000      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1379     63.245.221.11   ff       mozilla corporation  80       6        Dell      Apple     66      0      
201     10       0x0000000000004001  1258562467.754689  0.000000    0.000000      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   63.245.221.11   ff       mozilla corporation  80       192.168.1.104   02       private_reserved     1379     6        Apple     Dell      62      0      
202     10       0x0000000000004000  1258562467.754896  0.005754    0.005754      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1379     63.245.221.11   ff       mozilla corporation  80       6        Dell      Apple     64      0      
203     10       0x0000000000004000  1258562467.755633  0.000737    0.006491      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1379     63.245.221.11   ff       mozilla corporation  80       6        Dell      Apple     507     449    GET /thunderbird/2.0.0.23/start/ HTTP/1.1\r\nHost: www.mozillamessaging.com\r\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23\r\nAccept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\nAccept-Language: en-us,en;q=0.5\r\nAccept-Encoding: gzip,deflate\r\nAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\n\r\n
204     10       0x0000000000004001  1258562467.761440  0.006751    0.006751      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   63.245.221.11   ff       mozilla corporation  80       192.168.1.104   02       private_reserved     1379     6        Apple     Dell      54      0      
205     10       0x0000000000004001  1258562467.761692  0.000252    0.007003      3        eth:ipv4:tcp             00:19:e3:e7:5d:23  00:0b:db:4f:6b:10  0x0800   63.245.221.11   ff       mozilla corporation  80       192.168.1.104   02       private_reserved     1379     6        Apple     Dell      498     444    HTTP/1.1 302 Found\r\nServer: Apache/2.2.3 (CentOS)\r\nX-Powered-By: PHP/5.1.6\r\nLocation: http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.23/start/\r\nVary: Accept-Language,Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 20\r\nX-Varnish-IP: 10.200.74.11\r\nDate: Wed, 18 Nov 2009 16:44:02 GMT\r\nX-Varnish: 62432869 62419064\r\nAge: 17\r\nVia: 1.1 varnish\r\nConnection: keep-alive\r\n\r\n....................
206     10       0x0000000000004000  1258562467.900050  0.144417    0.150908      3        eth:ipv4:tcp             00:0b:db:4f:6b:10  00:19:e3:e7:5d:23  0x0800   192.168.1.104   02       private_reserved     1379     63.245.221.11   ff       mozilla corporation  80       6        Dell      Apple     64      0
...

Look at the duration column, you see several packets comming on a 0.3s-1s basis until packet number 200. There the duration interval jumps by 18252.71sec. Hence, there was no packet in between. Since we are in pcap synchronization mode: MONINTTMPCP 1, the monitoring is synchronized to the packet dissection, so you will not see samples every 10s, which you could expect at an interface in realtime MONINTTMPCP 0. If you need to sample the monitoring output for later decent signal processing, a small awk script will do the trick; have a look at the encrypted traffic mining tutorial. With a pcap you have to live with these gaps in the output. No Packets, no monitoring in pcap time. If you have a pcap with regular packet flow, all is fine. So the reader may try skypeu.pcap and see a nicer spacing.

Adding/Removing protocols

Let’s look into controlling the output of the monitoring/reporting mode. As indicted above the L3/L4 protocols being displayed are dependent on the plugins being loaded and the constants:

  • MONPROTL3
  • MONPROTL2

So either you use the constants defined in the file defined by MONPROTFL or just use the plain number of the protocol. So remove all ipv6 protocols, igmp, gre, SCTP and every L2 protocol as displayed below, commenting out the default configuration:

Recompile t2 and restart T2 and send a USR2 signal.

$ t2build tranalyzer2
...
$ t2 -r ~/data/skypeu.pcap -l 
%repTyp   time               dur           memUsageKB  fillSzHashMap  numFlows  numAFlows  numBFlows  numPkts  numAPkts  numBPkts  numV4Pkts  numV6Pkts  numVxPkts  numBytes  numABytes  numBBytes  numFrgV4Pkts  numFrgV6Pkts  numAlarms  rawBandwidth  globalWarn          ICMP  TCP  UDP  ftpPkts
USR1MR_D  1146661318.015009  9.272231      413004      2              2         1          1          176      90        86        176        0          0          11802     6034       5768       0             0             0          14.034        0x0000000200004000  0     176  0    0
USR1MR_D  1146661328.015302  10.000293     0           0              0         0          0          408      204       204       408        0          0          27338     13670      13668      0             0             0          25.180        0x0000000200004000  0     408  0    0
USR1MR_D  1146661338.031531  10.016229     0           0              0         0          0          391      200       191       391        0          0          26206     13400      12806      0             0             0          24.145        0x0000000200004000  0     391  0    0
USR1MR_D  1146661348.089037  10.057506     0           0              0         0          0          396      199       197       396        0          0          26538     13334      13204      0             0             0          24.326        0x0000000200004000  0     396  0    0
USR1MR_D  1146661358.000057  9.911020      0           0              0         0          0          395      198       197       395        0          0          26468     13268      13200      0             0             0          24.596        0x0000000200004000  0     395  0    0
USR1MR_D  1146661368.000377  10.000320     0           0              0         0          0          396      197       199       396        0          0          26536     13202      13334      0             0             0          24.447        0x0000000200004000  0     396  0    0
USR1MR_D  1146661378.043820  10.043443     0           0              0         0          0          402      200       202       402        0          0          26934     13400      13534      0             0             0          24.675        0x0000000200004000  0     402  0    0
USR1MR_D  1146661388.020862  9.977042      0           0              0         0          0          391      196       195       391        0          0          26204     13136      13068      0             0             0          24.225        0x0000000200004000  0     391  0    0
USR1MR_D  1146661398.029126  10.008264     0           0              0         0          0          397      200       197       397        0          0          26602     13400      13202      0             0             0          24.484        0x0000000200004000  0     397  0    0
USR1MR_D  1146661408.001388  9.972262      0           0              0         0          0          395      200       195       395        0          0          26470     13400      13070      0             0             0          24.463        0x0000000200004000  0     395  0    0
USR1MR_D  1146661418.013728  10.012340     0           0              0         0          0          392      195       197       392        0          0          26272     13070      13202      0             0             0          24.207        0x0000000200004000  0     392  0    0
USR1MR_D  1146661428.581968  10.568240     0           0              0         0          0          194      96        98        194        0          0          13002     6436       6566       0             0             0          11.315        0x0000000200004000  0     194  0    0
USR1MR_D  1146690149.215032  28720.633064  0           -1             1         1          0          8        4         4         8          0          0          536       268        268        0             0             0          0.000         0x0000000200004000  0     8    0    0
USR1MR_D  1146690159.054412  9.839380      0           1              1         0          1          197      99        98        197        0          0          13208     6636       6572       0             0             0          14.542        0x0000000200004000  0     197  0    0
USR1MR_D  1146690169.051267  9.996855      0           0              0         0          0          408      204       204       408        0          0          27338     13670      13668      0             0             0          25.189        0x0000000200004000  0     408  0    0
USR1MR_D  1146690179.016154  9.964887      0           0              0         0          0          390      200       190       390        0          0          26140     13400      12740      0             0             0          24.216        0x0000000200004000  0     390  0    0
USR1MR_D  1146690189.012973  9.996819      0           0              0         0          0          395      199       196       395        0          0          26470     13334      13136      0             0             0          24.403        0x0000000200004000  0     395  0    0
USR1MR_D  1146690199.000000  9.987027      0           0              0         0          0          395      198       197       395        0          0          26468     13268      13200      0             0             0          24.409        0x0000000200004000  0     395  0    0
USR1MR_D  1146690209.022780  10.022780     0           0              0         0          0          398      197       201       398        0          0          26670     13202      13468      0             0             0          24.515        0x0000000200004000  0     398  0    0
USR1MR_D  1146690219.039590  10.016810     0           0              0         0          0          399      200       199       399        0          0          26734     13400      13334      0             0             0          24.571        0x0000000200004000  0     399  0    0
USR1MR_D  1146690229.040467  10.000877     0           0              0         0          0          394      196       198       394        0          0          26404     13136      13268      0             0             0          24.340        0x0000000200004000  0     394  0    0
USR1MR_D  1146690239.049341  10.008874     0           0              0         0          0          397      200       197       397        0          0          26602     13400      13202      0             0             0          24.479        0x0000000200004000  0     397  0    0
USR1MR_D  1146690249.030201  9.980860      0           0              0         0          0          395      200       195       395        0          0          26470     13400      13070      0             0             0          24.442        0x0000000200004000  0     395  0    0
USR1MR_D  1146690259.015097  9.984896      0           0              0         0          0          390      193       197       390        0          0          26140     12938      13202      0             0             0          24.168        0x0000000200004000  0     390  0    0
...

The removed protocols are now excluded, as configured. The jump in the middle is caused by two consequtive skype conversations in the pcap. Now reset the protocol config to default, by removing your constants out commenting the default ones:

Recompile T2 and test. We will now look a bit deeper into time bases and interface operations.

Time base on an interface and stuff

Again, on an interface it normally does not matter whether a pcap or real time base is choosen, unless the average packet rate is very erratic and sometimes is 0. Then it is beneficial to use the default real time base: MONINTTMPCP 0.

Hmmm, so a pcap which processes 1 minute would then indeed generate monitoring output, but only on your time base uncorrelated to the pcap time.

The same will happen on an interface if there are traffic gaps. The solution is to switch to real time, MONINTTMPCP 0, and interrupt printing: MONINTPSYNC 0, so printing is not synchronized to the core main loop containing the blocking pcap functions. Moreover, we like t2 to start immediately after invokation with the monitoring processes, so set MONINTTMPCP_ON 1.

So your config should look like this:

Recompile tranalyzer: t2build tranalyzer2, invoke T2 on an interface, bind him just for fun to cpu 1 -c1 option, so he won’t jump to others directed by the operating system.

Now T2 starts right away with monitoring output and you will see almost an equal spacing of 10sec. That the difference is not exactly 10s can be ascribed to the fact that the minimum precision of the internal timebase is seconds. In future this will be addressed.

$ st2 -i yourinterface  -p /home/wurst/.tranalyzer/plugins/ -c1
%repTyp   time               dur        pktsRec  pktsDrp  ifDrp  memUsageKB  fillSzHashMap  numFlows  numAFlows  numBFlows  numPkts  numAPkts  numBPkts  numV4Pkts  numV6Pkts  numVxPkts  numBytes  numABytes  numBBytes  numFrgV4Pkts  numFrgV6Pkts  numAlarms  rawBandwidth  globalWarn          0x0042  0x00fe  0x0806  0x8035  0x0800  0x86dd  ICMP  IGMP  TCP    UDP  GRE  ICMPv6  SCTP
USR1MR_D  1548787267.186791  14.958605  57       0        0      349808      12             14        11         3          55       44        11        22         8          0          5327      4442       885        0             0             0          2.849         0x000010000000c044  8       0       17      0       22      8       0     0     19     0    0    5       0
USR1MR_D  1548787277.202349  10.015558  206      0        0      172         5              7         6          1          150      71        79        132        5          0          140352    7051       133301     0             0             0          112.107       0x000010000000c064  5       0       7       0       132     5       0     0     124    6    0    3       0
USR1MR_D  1548787286.227861  9.025512   236      0        0      0           2              2         1          1          30       24        6         12         7          0          3380      2735       645        0             0             0          2.996         0x000010000000c064  5       0       6       0       12      7       0     0     8      2    0    5       0
USR1MR_D  1548787297.549944  11.322083  267      0        0      0           2              2         1          1          31       23        8         15         5          0          4140      3035       1105       0             0             0          2.925         0x000010000000c064  5       0       6       0       15      5       0     0     11     2    0    3       0
USR1MR_D  1548787306.227806  8.677862   287      0        0      0           1              1         1          0          17       17        0         3          2          0          1687      1687       0          0             0             0          1.555         0x000010000000c064  5       0       6       0       3       2       0     0     0      1    0    0       0
USR1MR_D  1548787317.261862  11.034056  318      0        0      0           2              2         2          0          33       27        6         13         7          0          3723      3156       567        0             0             0          2.699         0x000010000000c064  5       0       8       0       13      7       0     0     10     1    0    5       0
USR1MR_D  1548787328.023106  10.761244  361      0        0      0           4              4         2          2          43       30        13        24         4          0          5272      3728       1544       0             0             0          3.919         0x000010000000c064  5       0       10      0       24      4       0     0     18     4    0    2       0
USR1MR_D  1548787338.296093  10.272987  403      0        0      0           5              5         3          2          44       37        7         16         10         0          4876      3860       1016       0             0             0          3.797         0x000010000000c064  6       0       11      0       16      10      0     0     10     6    0    6       0
USR1MR_D  1548787347.308612  9.012519   429      0        0      0           -2             0         0          0          24       18        6         12         2          0          2795      2228       567        0             0             0          2.481         0x000010000000c064  4       0       6       0       12      2       0     0     10     0    0    0       0
USR1MR_D  1548787357.327140  10.018528  504      0        0      124         8              8         5          3          74       47        27        56         5          0          11141     7649       3492       0             0             0          8.896         0x000010000200c064  5       0       8       0       56      5       0     0     40     14   0    3       0
USR1MR_D  1548787368.341794  11.014654  1847     0        0      288         88             88        48         40         1225     591       634       1201       7          0          987845    94594      893251     0             0             0          717.477       0x000010000200c064  6       0       10      0       1201    7       0     0     1181   18   0    5       0
USR1MR_D  1548787378.226863  9.885069   13613    0        0      688         -17            169       81         88         11887    5266      6621      11871      5          0          12217621  500969     11716652   0             0             0          9887.737      0x000010000200c064  5       0       6       0       11871   5       0     0     11825  44   0    3       0
USR1MR_D  1548787386.474237  8.247374   15655    0        0      0           4              4         2          2          2041     808       1233      2024       7          0          2527117   76307      2450810    0             0             0          2451.318      0x000010000200c064  4       0       6       0       2024    7       0     0     2018   4    0    5       0
USR1MR_D  1548787397.571349  11.097112  16810    0        0      0           0              2         1          1          1155     460       695       1137       2          0          1443714   37992      1405722    0             0             0          1040.785      0x000010000200c064  5       0       10      0       1137    2       0     0     1133   2    0    0       0
USR1MR_D  1548787408.226559  10.655210  19895    0        0      0           6              6         3          3          3086     1185      1901      3065       5          0          3926424   92406      3834018    0             0             0          2947.984      0x000010000200c064  6       0       10      0       3065    5       0     0     3057   6    0    3       0
USR1MR_D  1548787417.416724  9.190165   21926    0        0      0           2              2         1          1          2030     794       1236      2012       7          0          2586151   66091      2520060    0             0             0          2251.234      0x000010000200c064  4       0       7       0       2012    7       0     0     2008   2    0    5       0
USR1MR_D  1548787428.220451  10.803727  25132    0        0      0           2              2         1          1          3057     1187      1870      3039       5          0          3906502   93484      3813018    0             0             0          2892.707      0x000010000200c064  5       0       7       0       3039    5       0     0     3035   2    0    3       0
USR1MR_D  1548787437.448997  9.228546   26608    0        0      0           4              4         2          2          1623     618       1005      1608       2          0          2095763   47369      2048394    0             0             0          1816.766      0x000010000200c064  5       0       8       0       1608    2       0     0     1602   4    0    0       0
USR1MR_D  1548787447.465514  10.016517  28542    0        0      0           2              2         1          1          1936     744       1192      1917       7          0          2475347   58981      2416366    0             0             0          1977.012      0x000010000200c064  5       0       7       0       1917    7       0     0     1913   2    0    5       0
USR1MR_D  1548787457.485122  10.019608  29847    0        0      0           1              2         1          1          1305     504       801       1287       5          0          1658515   40878      1617637    0             0             0          1324.216      0x000010000200c064  5       0       7       0       1287    5       0     0     1283   2    0    3       0
USR1MR_D  1548787468.225942  10.740820  31899    0        0      0           -3             4         2          2          2053     813       1240      2034       5          0          2593050   67853      2525197    0             0             0          1931.361      0x000010000200c064  6       0       8       0       2034    5       0     0     2028   4    0    3       0
USR1MR_D  1548787477.405385  9.179443   32057    0        0      0           2              4         3          1          156      79        77        134        7          0          137745    7918       129827     0             0             0          120.046       0x000010000200c064  4       0       11      0       134     7       0     0     122    10   0    5       0
...	

You may now start another Anteater and bind him to cpu 2, and maybe with other plugins, which you have to copy into e.g. ~/.tranalyzer/pluginsOther

Now control the two independently by the kill command. If you use t2stat, it will send the same signal to both. That exercise is left to the reader. Let us now concentrate on the practitioner who likes to send logs to centralized machines processing them with his preferred tool. So how can he log into tools residing on a remote machine?

Logging into remote tools

An easy way to log into remote machines is to use netcat. Open a bash and start a netcat listener port 5555. We use the local interface to make it easier for the users, who have no access to another machine. If you want to send it anyway to another machine, just swap 127.0.0.1 with the ip address of your remote host. And mind your firewall policies.

Change the interval to 1 sec so that we get enough samples to see some reaction in time:

Compile T2 and start t2 on an interface and pipe it into a netcat sender to port 5555:

In the listener bash window, lines should now continually appear. These can be stored into a file or piped into a logging tool such as RRD. Let’s try that.

Logging into RRD tool

Download RRD Tool and install it.

To convert T2 output into the RRD DB language the rrdmonitor script is needed:

$ rrdmonitor -h 
Usage:
        rrdmonitor [OPTION...]

Options:
    -d name    creates a DB file named 'name' [default: monitoring.rrd]
    -k         append data to existing database [default: create a new DB]
    -h, -?     display this help and exit

In our case we only need to pipe T2 output into rrdmonitor and then plot using rrdplot:

$ t2 -r ~/data/faf-exercise.pcap | rrdmonitor
$ rrdplot -h
Usage:
    rrdplot [OPTION...] [FIELD1] [FIELD2]

Options:
    -d name    name of the database to use [default: monitoring.rrd]
    -p name    name of the PNG to generate [default: field1[_field2].png]
    -r wxh     size of the generated PNG (width x height) [default: 640x480]

    -s start   start time of the plot [default: end-10m]
               (use special value 'first' to plot from the first record)
    -e end     end time of the plot [default: last]
               (use special value 'last' to plot until the last record)
    -i int     interval to plot [default: 10m (last 10min)]
               ([s]econds, [m]inutes, [h]ours, [d]ays, [w]eeks, [mo]nth, [y]ear)
    -a         plot the whole database

    -U int     update the plot every 'int' seconds [default: 1]
    -n         generate a fixed plot for the given interval and exit
    -R         real-time: plot regular intervals (see -U option)
               [default: plot to the last update]

    -f         display Holt-Winters confidence bands
    -t win     display the 'win' hour trend

    -x         use logarithmic axis
    -u max     crop values to 'max'
    -l min     crop values to 'min'

    -b         do not display the anteater banner

    -L         List the fields available in the database and exit
    -I         display info about the database and exit

    -h         display this help and exit

    FIELD1 and FIELD2 can be one of the following:
        memUsageKB             fillSzHashMap          numFlows       
        numAFlows              numBFlows              numPkts        
        numAPkts               numBPkts               numV4Pkts      
        numV6Pkts              numVxPkts              numBytes       
        numABytes              numBBytes              numFrgV4Pkts   
        numFrgV6Pkts           numAlarms              rawBandwidth   
        0x0042                 0x00fe                 0x0806         
        0x8035                 0x0800                 0x86dd         
        ICMP                   IGMP                   TCP            
        UDP                    GRE                    ICMPv6         
        SCTP                   ftpPkts        
$

On an interface you will see a constant update:

st2 -i yourInterface -l | rrdmonitor 

in the other bash:

$ rrdplot -b numABytes_numBBytes.png
RRD plot numABytes_numBBytes
RRD plot numABytes_numBBytes

You can watch now while you are working, add more rrdplot to display other colums.

Now try a pcap annoloc2.pcap. Reset monitoring to default real time base in main.h:

...
#define MONINTTMPCP    0 // Monitoring: 1: pcap time base, 0: real time base.
...

recompile T2 and run it on the pcap:

$ t2build tranalyzer2
...

$ st2 -r ~/data/annoloc2.pcap -l | rrdmonitor 
$
$ rrdplot -n -e last -i 30s numAFlows numBFlows
$
RRD plot numAFlows numBFlows
RRD plot numAFlows numBFlows

If you do not like the nice Anteater, then use the -b option. The default is number of flows. If we want to see numAPkts numBPkts:

$ rrdplot -n -e last -i 30s numAPkts numBPkts
$
RRD plot numAPkts_numBPkts
RRD plot numAPkts_numBPkts