flowtag 2.1.1 → 2.1.2

data/README.rdoc

@@ -1,6 +1,18 @@
 = flowtag
+FlowTag is an interactive network trace viewer. It operates on PCAP files, produces a database of flows, and then visualizes the results. The user can then filter for flows of interest, view the payload, and tag the flow with relevant keywords. The current version is written in Ruby using the Tk interface. The code is released under GPL, except the pcapparser library, which is released under LGPL.
 
-Description goes here.
+<img src='http://chrislee.dhs.org/projects/flowtag/flowtag2.png' />
+
+The interface is comprised of 6 main elements as follows:
+
+* Flow Table. A list of matching flows (source IP, destination IP, source port, destination port, and time). When a flow in this table is clicked on, the contents of the flow will be displayed in the Payload View.
+* Flow Tags. This small entry box allows the user to associate keywords (tags) with the currently selected flow.
+* Payload View. When the user clicks on a flow in the Flow Table, the reconstructed payload of the currently selected flow is displayed in this text box.
+* Connection Visualization. This canvas displays a parallel coordinate plot with the left axis mapping the TCP ports (using a cube root scaling to emphasize the lower ports) and the right axis mapping the IP addresses in order of appearance in the network trace file.
+* Filters. Filters allow the user to remove uninteresting flows based on time, the number of packets in the flow, or the number of bytes in the flow. The time slider is a double-ended linear slider and the packets and bytes sliders are double-ended logarithmic sliders (to give lower numbers have more selection accuracy since they generally more important).
+* Tags List. This selector lists all the defined tags and allows the user to filter for flow matching the selected tag.
+
+The FlowTag package contains 3 command-line tools in addition to the GUI. These tools are provided to telp with simple automation and scripting. pcap2flowdb creates a flow database from a pcap file. The database can then be read by the listflows and printflow tools. The listflows tool lists all the flow tuples contained in the flow database. The printflow tool outputs the payload of a specified flow.
 
 == Contributing to flowtag
  

data/lib/flowtag/pcapparser.rb

@@ -66,8 +66,8 @@ module FlowTag
 			@ip = (data[12,2].unpack("n")[0] == 0x0800) ? true : false
 			offset = 14
 			if @ip
-				@ip_hlen = (data[offset].ord & 0x0f) << 2
-				@ip_proto = data[offset+9].ord
+				@ip_hlen = (data[offset,1].unpack("C")[0] & 0x0f) << 2
+				@ip_proto = data[offset+9,1].unpack("C")[0]
 				@ip_src, @ip_dst = data[offset+12,8].unpack("NN")
 				offset += @ip_hlen
 				@tcp = true if @ip_proto == 0x06
@@ -76,7 +76,7 @@ module FlowTag
 					@sport, @dport = data[offset,4].unpack("nn")
 					@tcp_sport = @sport
 					@tcp_dport = @dport
-					@tcp_hlen = (data[offset+12]>>4)<<2
+					@tcp_hlen = (data[offset+12,1].unpack("C")[0] >> 4) << 2
 					offset += @tcp_hlen
 				elsif @udp
 					@sport, @dport = data[offset,4].unpack("nn")

metadata

@@ -1,13 +1,12 @@
 --- !ruby/object:Gem::Specification 
 name: flowtag
 version: !ruby/object:Gem::Version 
-  hash: 9
-  prerelease: 
+  prerelease: false
   segments: 
   - 2
   - 1
-  - 1
-  version: 2.1.1
+  - 2
+  version: 2.1.2
 platform: ruby
 authors: 
 - Chris Lee
@@ -37,133 +36,117 @@ cert_chain:
   6yhklP75
   -----END CERTIFICATE-----
 
-date: 2011-03-09 00:00:00 -05:00
+date: 2012-12-20 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :runtime
+  name: tk-double-slider
   version_requirements: &id001 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 27
         segments: 
         - 0
         - 1
         - 0
         version: 0.1.0
   requirement: *id001
+- !ruby/object:Gem::Dependency 
   prerelease: false
-  name: tk-double-slider
   type: :runtime
-- !ruby/object:Gem::Dependency 
+  name: tk-parallel-coordinates
   version_requirements: &id002 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 27
         segments: 
         - 0
         - 1
         - 0
         version: 0.1.0
   requirement: *id002
-  prerelease: false
-  name: tk-parallel-coordinates
-  type: :runtime
 - !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :development
+  name: shoulda
   version_requirements: &id003 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
   requirement: *id003
+- !ruby/object:Gem::Dependency 
   prerelease: false
-  name: shoulda
   type: :development
-- !ruby/object:Gem::Dependency 
+  name: bundler
   version_requirements: &id004 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 23
         segments: 
         - 1
-        - 0
-        - 0
-        version: 1.0.0
+        - 2
+        - 3
+        version: 1.2.3
   requirement: *id004
+- !ruby/object:Gem::Dependency 
   prerelease: false
-  name: bundler
   type: :development
-- !ruby/object:Gem::Dependency 
+  name: jeweler
   version_requirements: &id005 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 7
         segments: 
         - 1
-        - 5
-        - 2
-        version: 1.5.2
+        - 8
+        - 4
+        version: 1.8.4
   requirement: *id005
+- !ruby/object:Gem::Dependency 
   prerelease: false
-  name: jeweler
   type: :development
-- !ruby/object:Gem::Dependency 
+  name: rcov
   version_requirements: &id006 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 3
         segments: 
         - 0
         version: "0"
   requirement: *id006
-  prerelease: false
-  name: rcov
-  type: :development
 - !ruby/object:Gem::Dependency 
+  prerelease: false
+  type: :runtime
+  name: tk-double-slider
   version_requirements: &id007 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 27
         segments: 
         - 0
         - 1
         - 0
         version: 0.1.0
   requirement: *id007
+- !ruby/object:Gem::Dependency 
   prerelease: false
-  name: tk-double-slider
   type: :runtime
-- !ruby/object:Gem::Dependency 
+  name: tk-parallel-coordinates
   version_requirements: &id008 !ruby/object:Gem::Requirement 
-    none: false
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        hash: 27
         segments: 
         - 0
         - 1
         - 0
         version: 0.1.0
   requirement: *id008
-  prerelease: false
-  name: tk-parallel-coordinates
-  type: :runtime
 description: presents the user with a GUI interface to visualize and explore flows found from a given pcap file
 email: rubygems@chrislee.dhs.org
 executables: 
@@ -188,8 +171,6 @@ files:
 - lib/flowtag/pcapparser.rb
 - LICENSE.txt
 - README.rdoc
-- test/helper.rb
-- test/test_flowtag.rb
 has_rdoc: true
 homepage: https://rubygems.org/gems/flowtag
 licenses: 
@@ -200,30 +181,25 @@ rdoc_options: []
 require_paths: 
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.6.1
+rubygems_version: 1.3.6
 signing_key: 
 specification_version: 3
 summary: FlowTag visualizes pcap files for forensic analysis
-test_files: 
-- test/helper.rb
-- test/test_flowtag.rb
+test_files: []
+

data/test/helper.rb

@@ -1,18 +0,0 @@
-require 'rubygems'
-require 'bundler'
-begin
-  Bundler.setup(:default, :development)
-rescue Bundler::BundlerError => e
-  $stderr.puts e.message
-  $stderr.puts "Run `bundle install` to install missing gems"
-  exit e.status_code
-end
-require 'test/unit'
-require 'shoulda'
-
-$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
-$LOAD_PATH.unshift(File.dirname(__FILE__))
-require 'flowtag'
-
-class Test::Unit::TestCase
-end

data/test/test_flowtag.rb

@@ -1,63 +0,0 @@
-require 'helper'
-require 'pp'
-class TestFlowtag < Test::Unit::TestCase
-	flow = ['192.168.44.100', '72.14.207.99', 50697, 80]
-	
-	should "create a flowdb from the test.pcap and dump the flows" do
-		File.unlink('test/test.pcap.flows') if File.exists?('test/test.pcap.flows')
-		File.unlink('test/test.pcap.pkts') if File.exists?('test/test.pcap.pkts')
-		File.unlink('test/test.pcap.tags') if File.exists?('test/test.pcap.tags')
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		assert(File.exists?('test/test.pcap.flows'))
-		assert(File.exists?('test/test.pcap.pkts'))
-		assert(File.exists?('test/test.pcap.tags'))
-		fdb.dumpflows
-	end
-	
-	should "get the first pktid of the test.pcap" do
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		pid = fdb.getfirstpktid(*flow)
-		assert_equal(0,pid)
-	end
-	
-	should "return no tags for the first flow" do
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		tags = fdb.getflowtags(flow)
-		assert_equal(0,tags.length)
-	end
-	
-	should "get all flows tagged with test should be empty" do
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		flows = fdb.flows_taggedwith("test")
-		assert_equal(0,flows.length)
-	end
-	
-	should "tag the first flow with test and retrieve it" do
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		fdb.tag_flow(flow,["test"])
-		flows = fdb.flows_taggedwith("test")
-		assert_equal(1,flows.length)
-	end
-	
-	should "write the tags database and reload" do
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		fdb.tag_flow(flow,["test"])
-		fdb.writetagdb
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		flows = fdb.flows_taggedwith("test")
-		assert_equal(1, flows.length)
-		fdb.tag_flow(flow,[])
-		fdb.writetagdb
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		flows = fdb.flows_taggedwith("test")
-		assert_equal(0, flows.length)
-	end
-	
-	should "list all the tags and receive one, test" do
-		fdb = FlowTag::FlowDB.new('test/test.pcap')
-		fdb.tag_flow(flow,["test"])
-		tags = fdb.tags
-		assert_equal(1, tags.length)
-		assert_equal("test", tags[0])
-	end
-end