NetworkFrameFilter

Table of Contents

1. Abstract
2. Command
   1. Online
   2. Offline
   3. Help
3. Protocols supported
   1. Network
   2. Transport
   3. Application
4. Additional tool
   1. Verbosity
   2. Filtering
   3. Documentation
   4. Tests
5. Credits

Abstract

Analyze network frame on severals protocols such as Bootp, DNS, SMTP, DHCP etc...
(refer to the documentation for the protocols supported).
Availabilities of analyzing online frame on your Laptop's port, or offline with the assets given.

Choose the level of information printed with the verbosity (by default all is printed).
Choose particular protocols with the filter.

The name of files in source and include repertories are prefixed by the number of the protocol's layer they are related to :
1 - Physical
2 - Network
3 - Transport
4 - Application

Command

Online

sudo ./bin/exe -i <interface> -v <verbosity> -f <filter>

Offline

./bin/exe -o <file> -v <verbosity> -f <filter>

Help

./bin/exe -h

Protocols supported

Physical

• Ethernet

Network

• IPv4
• ARP
• IPv6

Transport

• UDP
• TCP
• SCTP
• ICMP

Application

• DNS
• BOOTP
• DHCP
• SMTP
• HTTP
• FTP
• POP3
• IMAP
• Telnet

Additional tool

Verbosity

Verbosity is a number between 1 and 3.
1 - Essential informations of the frame (one line by frame)
2 - Essential informations and their complements (one line by layer)
3 - All informations is printed

Filtering

Filter is a string you enter for chosing a type of packet on online listening.
The packet available are :

• arp
• bootp
• dhcp
• dns
• ftp
• http
• imap
• pop3
• smtp
• telnet
• tcp
• udp

To select transport layer, you have to enter the protocol name.
For example, if you want to see only the TCP packets, you have to enter :

./bin/exe -i <interface> -f tcp

To select application protocol you need to input the port number.
For example, if you want to listen only the DNS packets, you can enter :

./bin/exe -i <interface> -f "udp port 53"

Documentation

You can create the documentation with the following command :

make docs

The documentation is available in the repertory "styles".

Tests

There is a bash script to test the possible error of the program with valgrind.
The test is on the offline mode with all the assets given.

make tests

Credit

You can find the assets used at the following address :
https://packetlife.net/captures/protocol/
With the download of the packets, you can compare the informations printed with the CloudShark given by packets.