SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
This dataset holds simulated PCAP (packet capture) data from the SCEPTRE validation demonstration model as a set of pairwise communications between devices via specific protocols. All connections should be assumed to be symmetric, as this data is an aggregation of the true PCAP. A mapping is also provided associating each IP address with its true device type.
The goal of this project is to automate log analysis by utilizing Splunk, Bash, and Python together. Simplifying the monitoring and analysis of network traffic was the main goal. In order to accomplish this, a Bash script was created to use 'tcpdump' to automate network sniffing. It also included a 24-hour file rotation mechanism to effectively manage the pcap files that were generated. After that, a Python script was written to read these pcap files and retrieve pertinent data about network traffic. After processing the collected data, Splunk is used to summarize the important metrics and visualize said information with relevant graphs.
This software allows the user to visualize complex PCAP-ng files captured from network capture software such as Wireshark. The visualization runs in a GUI window that can be zoomed or moved to areas of interest in a waterfall type display. The user then can see an area of interest that looks different than the typical traffic visually, such as a human interaction or non-repetitive area of data. The program will tell the user the packet number and byte offset of interest for fast analysis of discrete atomic or non-random events. This is particularly useful for visualization of unknown binary format data, such as in PLC or SCADA protocols that may have human or other non-repetitive activity for further analysis, reverse engineering, or fast forensic analysis.
Summary of Malcolm, an INL open source project dealing with network traffic analysis. History and overview of the project. All information is open source and is already publicly available on the IdahoLab GitHub page.