FlowParser 0.1.6

Use Cases

What could you possibly use another packet sniffer for?

• Active monitoring of flows in / out of your machine / network. Ever wondered what flows are currently active and how much bandwidth they are using? FlowParser is an easy-to-use lightweight way of finding out.

• Looking for anomalies in header fields. FlowParser will let you spot and record flows that for example have strange variation in TTL.

• Quick offline data parsing. If you are looking for a specific flow or you want to study the behavior of a class of flows in a multi-GB packet trace FlowParser can help you accomplish the task quickly and easily.

And lots more. In general the idea is that reconstructing a flow and looking at the header fields of its packets should be as quick and painless as a couple of lines of Python.

Simple Example

This simple snippet will start listening to the en0 interface and every ten seconds will print the five-tuple id of flows that go faster than 1KB per second:

import fparser
import time

fp = fparser.FParser('en0')

while True:
      time.sleep(10)
      for flow in fp.flow_iter():
          if flow.get_info().Bps > 1000:
             print flow.get_id()