Scripting is an essential part of the FMADIO packet capture systems as packet capture is only the first step in the process of understanding your network traffic. We have released a small (but growing) library of commands to help integrate into your environment.
SCRIPT INTEGRATION
To get started here`s the link on Github.
https://github.com/fmadio/fmadio_scripts
It`s currently not much but expect it to grow and evolve based on your needs and requests.
MIRROR CAPTURE DATA ON REMOTE MACHINE
The purpose is to "rsync a capture" so to speak with a twist. You can run in follow mode, so it constantly downloads new data of the currently active capture. Also you can choose how the data is split! e.g. 1 minute PCAP`s or 1GB PCAP`s or any of the other options. It does lazy state evaluation too, so already downloaded files are skipped the same as rsync.
Here`s an example of rsyncing the currently active capture at 1 second PCAP splits in follow/poll mode (download new data as it arrives).
$ ./capture_rsync.py --follow --host 192.168.1.1 --split split_1sec Follow Mode [./py4_160105_16:12:20.211.165.440 ] Downloading... 0.000 GB 0.877 sec 0.000000 Gbps [./py4_1618_20160105_16:18:50.749.243.904 ] Downloading... 0.343 GB 29.817 sec 0.091988 Gbps [./py4_1618_20160105_16:18:51.749.243.904 ] Downloading... 0.415 GB 38.029 sec 0.087294 Gbps [./py4_1618_20160105_16:18:52.749.243.904 ] Downloading... 0.488 GB 42.962 sec 0.090792 Gbps [./py4_1618_20160105_16:18:53.749.243.904 ] Downloading... 0.436 GB 43.522 sec 0.080117 Gbps [./py4_1618_20160105_16:18:54.749.243.904 ] Downloading... 0.110 GB 0.949 sec 0.931275 Gbps [./py4_1618_20160105_16:18:55.749.243.904 ] Downloading... 0.100 GB 0.860 sec 0.928788 Gbps [./py4_1618_20160105_16:18:56.749.243.904 ] Downloading... 0.109 GB 0.941 sec 0.930891 Gbps [./py4_1618_20160105_16:18:57.749.243.904 ] Downloading... 0.099 GB 2.317 sec 0.341684 Gbps [./py4_1618_20160105_16:18:58.749.243.904 ] Downloading... 0.078 GB 0.760 sec 0.820824 Gbps [./py4_1618_20160105_16:18:59.749.243.904 ] Downloading... 0.064 GB 0.784 sec 0.648858 Gbps [./py4_1618_20160105_16:19:00.749.243.904 ] Downloading... 0.099 GB 3.152 sec 0.250963 Gbps [./py4_1618_20160105_16:19:01.749.243.904 ] Downloading... 0.108 GB 1.268 sec 0.678948 Gbps [./py4_1618_20160105_16:19:02.749.243.904 ] Downloading... 0.113 GB 1.512 sec 0.596313 Gbps . . .
DOWNLOAD CAPTURE DATA ON REMOTE MACHINE WITH FILTERING
Used when you want to download only data from an IP range or Protocol specific packets. e.g. save on network bandwidth/time by downloading specific data your interested in. This feature helps speed up analysis and troubleshooting.
In the example below we`re downloading all data in the subnet 192.168.1.0/24 in follow/poll mode with 1GB PCAP splits. Note the filter is applied to 1GB source PCAP`s on the FMADIO device, with the filtered result sent down the network.
$ ./capture_rsync.py --host 192.168.1.1 --output fmadio20 --filter FilterIPHost=192.168.1.0/24 --follow Follow Mode [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:46:14.660.095.232 ] Downloading... 0.264 GB 3.971 sec 0.532612 Gbps [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:46:54.697.121.792 ] Downloading... 0.380 GB 7.556 sec 0.402748 Gbps [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:47:43.308.749.568 ] Downloading... 0.072 GB 1.186 sec 0.484051 Gbps Sleeping... [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:48:05.748.449.280 ] Downloading... 0.000 GB 1.226 sec 0.000267 Gbps [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:48:24.473.020.672 ] Downloading... 0.000 GB 1.933 sec 0.000176 Gbps [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:48:50.867.348.736 ] Downloading... 0.000 GB 1.851 sec 0.000077 Gbps [fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:49:10.676.263.424 ] Downloading... 0.010 GB 2.225 sec 0.037457 Gbps Sleeping... . .
LOCAL CONFIG
As always typing in the username/password/hostname sucks and is a security risk. The scripts read a config file from ~/.fmadio.config for default parameters. An example is shown below.
$ cat ~/.fmadio.conf [General] username=fmadio password=secret hostname=192.168.1.1 protocol=http $
.. AND MORE TO COME
Its a small start, send us your requests, patches and questions. We`re more than happy to do the leg work in the library code to get you up and running as quickly as possible.
