Opensource Script Library
Scripting is an essential part of the FMADIO packet capture systems as packet capture is only the first step in the process of understanding your network traffic. We have released a small (but growing) library of commands to help integrate into your environment.
Script Integration
To get started here`s the link on Github.
https://github.com/fmadio/fmadio_scripts
It`s currently not much but expect it to grow and evolve based on your needs and requests.
Mirror Capture Data on Remote Machine
The purpose is to "rsync a capture" so to speak with a twist. You can run in follow mode, so it constantly downloads new data of the currently active capture. Also you can choose how the data is split! e.g. 1 minute PCAP`s or 1GB PCAP`s or any of the other options. It does lazy state evaluation too, so already downloaded files are skipped the same as rsync.
Here`s an example of rsyncing the currently active capture at 1 second PCAP splits in follow/poll mode (download new data as it arrives).
$ ./capture_rsync.py --follow --host 192.168.1.1 --split split_1sec
Follow Mode
[./py4_160105_16:12:20.211.165.440 ] Downloading... 0.000 GB 0.877 sec 0.000000 Gbps
[./py4_1618_20160105_16:18:50.749.243.904 ] Downloading... 0.343 GB 29.817 sec 0.091988 Gbps
[./py4_1618_20160105_16:18:51.749.243.904 ] Downloading... 0.415 GB 38.029 sec 0.087294 Gbps
[./py4_1618_20160105_16:18:52.749.243.904 ] Downloading... 0.488 GB 42.962 sec 0.090792 Gbps
[./py4_1618_20160105_16:18:53.749.243.904 ] Downloading... 0.436 GB 43.522 sec 0.080117 Gbps
[./py4_1618_20160105_16:18:54.749.243.904 ] Downloading... 0.110 GB 0.949 sec 0.931275 Gbps
[./py4_1618_20160105_16:18:55.749.243.904 ] Downloading... 0.100 GB 0.860 sec 0.928788 Gbps
[./py4_1618_20160105_16:18:56.749.243.904 ] Downloading... 0.109 GB 0.941 sec 0.930891 Gbps
[./py4_1618_20160105_16:18:57.749.243.904 ] Downloading... 0.099 GB 2.317 sec 0.341684 Gbps
[./py4_1618_20160105_16:18:58.749.243.904 ] Downloading... 0.078 GB 0.760 sec 0.820824 Gbps
[./py4_1618_20160105_16:18:59.749.243.904 ] Downloading... 0.064 GB 0.784 sec 0.648858 Gbps
[./py4_1618_20160105_16:19:00.749.243.904 ] Downloading... 0.099 GB 3.152 sec 0.250963 Gbps
[./py4_1618_20160105_16:19:01.749.243.904 ] Downloading... 0.108 GB 1.268 sec 0.678948 Gbps
[./py4_1618_20160105_16:19:02.749.243.904 ] Downloading... 0.113 GB 1.512 sec 0.596313 Gbps
.
.
.
Download Capture Data on Remote Machine with Filtering
Used when you want to download only data from an IP range or Protocol specific packets. e.g. save on network bandwidth/time by downloading specific data your interested in.
This feature helps speed up analysis and troubleshooting.
In the example below we`re downloading all data in the subnet 192.168.1.0/24 in follow/poll mode with 1GB PCAP splits. Note the filter is applied to 1GB source PCAP`s on the FMADIO device, with the filtered result sent down the network.
$ ./capture_rsync.py --host 192.168.1.1 --output fmadio20 --filter FilterIPHost=192.168.1.0/24 --follow
Follow Mode
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:46:14.660.095.232 ] Downloading... 0.264 GB 3.971 sec 0.532612 Gbps
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:46:54.697.121.792 ] Downloading... 0.380 GB 7.556 sec 0.402748 Gbps
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:47:43.308.749.568 ] Downloading... 0.072 GB 1.186 sec 0.484051 Gbps
Sleeping...
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:48:05.748.449.280 ] Downloading... 0.000 GB 1.226 sec 0.000267 Gbps
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:48:24.473.020.672 ] Downloading... 0.000 GB 1.933 sec 0.000176 Gbps
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:48:50.867.348.736 ] Downloading... 0.000 GB 1.851 sec 0.000077 Gbps
[fmadio20_landata_20160105_2145_split_1GB/landata_20160105_2145__20160105_21:49:10.676.263.424 ] Downloading... 0.010 GB 2.225 sec 0.037457 Gbps
Sleeping...
.
.
Local Config
As always typing in the username/password/hostname sucks and is a security risk. The scripts read a config file from ~/.fmadio.config for default parameters. An example is shown below.
$ cat ~/.fmadio.conf
[General]
username=fmadio
password=secret
hostname=192.168.1.1
protocol=http
$
.. and more to come
Its a small start, send us your requests, patches and questions. We`re more than happy to do the leg work in the library code to get you up and running as quickly as possible.
