net-tools
net-tools

目次


mergecap を使ってみる

二つのキャプチャファイルを一つのファイルにマージし、キャプチャ時刻でソートする

icmp.pcapとicmp2.pcapをマージする例です。

icmp.pcapは以下のとおり 
C:\temp>tshark -r icmp.pcap
  1   0.000000 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  2   0.001854 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  3   1.001200 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  4   1.003057 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  5   2.002509 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  6   2.004445 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  7   3.002580 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  8   3.004457 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  9   4.004794 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 10   4.006649 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 11   5.006993 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 12   5.008849 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 13   6.009171 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 14   6.011009 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 15   7.011374 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 16   7.013221 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 17   8.013575 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 18   8.015412 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 19   9.015765 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 20   9.017621 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 21  10.017956 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 22  10.019831 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 23  11.020171 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 24  11.022024 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply

icmp2.pcapは以下のとおり 
C:\temp>tshark -r icmp2.pcap
  1   0.000000 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
  2   0.001733 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
  3   0.996747 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
  4   0.998461 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
  5   1.997933 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
  6   2.001069 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
  7   2.998119 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
  8   2.999845 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply

icmp.pcapとicmp2.pcapをマージし、icmp3.pcapというファイル名にします。
（"-v"オプションを使うことで以下のように、マージしたフレーム数を表示できます。オプションを指定しないと、以下のように何も表示されません。） 
C:\temp>mergecap -w icmp3.pcap icmp.pcap icmp2.pcap

icmp3.pcapを確認してみます。
192.168.11.2～192.168.11.1の多くの通信の中に、192.168.11.2～192.168.11.5の通信がマージされている様子がわかります。 
C:\temp>tshark -r icmp3.pcap
  1   0.000000 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  2   0.001854 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  3   1.001200 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  4   1.003057 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  5   2.002509 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  6   2.004445 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  7   3.002580 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  8   3.004457 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  9   4.004794 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 10   4.006649 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 11   5.006993 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 12   5.008849 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 13   6.009171 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 14   6.011009 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 15   6.149051 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 16   6.150784 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 17   7.011374 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 18   7.013221 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 19   7.145798 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 20   7.147512 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 21   8.013575 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 22   8.015412 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 23   8.146984 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 24   8.150120 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 25   9.015765 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 26   9.017621 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 27   9.147170 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 28   9.148896 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 29  10.017956 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 30  10.019831 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 31  11.020171 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 32  11.022024 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply

キャプチャ時刻に関係なく、二つのキャプチャファイルを順番に並べる

icmp.pcapとicmp2.pcapをこの順に並べて、icmp4.pcapを作るには-aオプションを使います。 
C:\temp>mergecap -a -w icmp4.pcap icmp.pcap icmp2.pcap

icmp4.pcapを確認します。
192.168.11.2～192.168.11.1の通信の後に、192.168.11.2～192.168.11.5の通信がはじまっていることがわかります。 
C:\temp>tshark -r icmp4.pcap
  1   0.000000 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  2   0.001854 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  3   1.001200 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  4   1.003057 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  5   2.002509 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  6   2.004445 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  7   3.002580 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
  8   3.004457 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
  9   4.004794 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 10   4.006649 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 11   5.006993 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 12   5.008849 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 13   6.009171 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 14   6.011009 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 15   7.011374 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 16   7.013221 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 17   8.013575 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 18   8.015412 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 19   9.015765 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 20   9.017621 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 21  10.017956 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 22  10.019831 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 23  11.020171 192.168.11.2 -> 192.168.11.1 ICMP Echo (ping) request
 24  11.022024 192.168.11.1 -> 192.168.11.2 ICMP Echo (ping) reply
 25   6.149051 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 26   6.150784 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 27   7.145798 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 28   7.147512 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 29   8.146984 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 30   8.150120 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply
 31   9.147170 192.168.11.2 -> 192.168.11.5 ICMP Echo (ping) request
 32   9.148896 192.168.11.5 -> 192.168.11.2 ICMP Echo (ping) reply

「020_使ってみる」をウィキ内検索
最終更新：2008年01月26日 00:44