{"id":482,"date":"2008-07-14T06:00:17","date_gmt":"2008-07-14T14:00:17","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/?p=482"},"modified":"2008-07-10T07:30:06","modified_gmt":"2008-07-10T15:30:06","slug":"analyze-packet","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2008\/07\/14\/analyze-packet\/","title":{"rendered":"Analyze-Packet"},"content":{"rendered":"

If you’ve been trying out the Get-Packet<\/a> script you’ve seen that there is a great deal of information. I wanted an easy way to analyze the data so I put together a script called Analyze-Packet that will slice and dice a saved network trace and produce a summary report.<\/p>\n

\n
\n
\n
   1:<\/span> Param([object]$sniff)<\/pre>\n
   2:<\/span>  <\/pre>\n
   3:<\/span> $activity="Analyzing network trace"<\/span><\/pre>\n
   4:<\/span> Write-Progress -Activity $activity -status "Counting packets"<\/span> -percentcomplete 1<\/pre>\n
   5:<\/span> $count = "Total packet count: {0}"<\/span> -f $sniff.count<\/pre>\n
   6:<\/span>  <\/pre>\n
   7:<\/span> Write-Progress -Activity $activity -status "Calculating elapsed time"<\/span> -percentcomplete 5<\/pre>\n
   8:<\/span> $elapsed = "Total elapsed time: {0}"<\/span> -f ($sniff[-1].time -$sniff[0].time).ToString()<\/pre>\n
   9:<\/span> #calculate packets per second<\/span><\/pre>\n
  10:<\/span> $pps = $sniff.count\/(($sniff[-1].time -$sniff[0].time).totalseconds)<\/pre>\n
  11:<\/span> $pps="{0:N4}"<\/span> -f $pps<\/pre>\n
  12:<\/span> $packetsPerSecond="Packets per second: $pps"<\/span><\/pre>\n
  13:<\/span>  <\/pre>\n
  14:<\/span> Write-Progress -Activity $activity -status "Calculating protocol distribution"<\/span> -percentcomplete 20<\/pre>\n
  15:<\/span> $protocols = $sniff | sort protocol | group protocol | sort count -descending | select Count,@{name="Protocol"<\/span>;Expression={$_.name}} <\/pre>\n
  16:<\/span>  <\/pre>\n
  17:<\/span> Write-Progress -Activity $activity -status "Building source list"<\/span> -percentcomplete 30<\/pre>\n
  18:<\/span> $sourcelist = $sniff | sort source | select Source<\/pre>\n
  19:<\/span>  <\/pre>\n
  20:<\/span> Write-Progress -Activity $activity -status "Calculating source distribution"<\/span> -percentcomplete 35<\/pre>\n
  21:<\/span> $ips = $sourcelist| group source |sort count -descending | select Count,Name<\/pre>\n
  22:<\/span>  <\/pre>\n
  23:<\/span> $sources=@()<\/pre>\n
  24:<\/span>  <\/pre>\n
  25:<\/span> #turn off errors to prevent the script from halting if an IP can't be resolved<\/span><\/pre>\n
  26:<\/span> $errorActionPreference="SilentlyContinue"<\/span><\/pre>\n
  27:<\/span>  <\/pre>\n
  28:<\/span> for<\/span> ($i=0;$i -lt<\/span> $ips.count;$i++) { <\/pre>\n
  29:<\/span>     Write-Progress -Activity $activity -status "Resolving Source IP addresses"<\/span> -currentoperation $ips[$i].name -percentcomplete (($i\/$ips.count)*100)<\/pre>\n
  30:<\/span>     <\/pre>\n
  31:<\/span>     $obj=New-Object PSObject<\/pre>\n
  32:<\/span>     $resolved=[system.Net.dns]::getHostEntry($ips[$i].Name).hostName<\/pre>\n
  33:<\/span>  <\/pre>\n
  34:<\/span>     if<\/span> (!$resolved) {<\/pre>\n
  35:<\/span>         $resolved="Not Found"<\/span><\/pre>\n
  36:<\/span>         }<\/pre>\n
  37:<\/span>     $obj | Add-Member -MemberType Noteproperty -name "Count"<\/span> -value $ips[$i].Count<\/pre>\n
  38:<\/span>     $obj | Add-Member -MemberType Noteproperty -name "IP"<\/span> -value $ips[$i].name<\/pre>\n
  39:<\/span>     $obj | Add-Member -MemberType Noteproperty -name "Host"<\/span> -value $resolved<\/pre>\n
  40:<\/span>     $sources+=$obj<\/pre>\n
  41:<\/span> }<\/pre>\n
  42:<\/span>  <\/pre>\n
  43:<\/span> #turn error pipeline back on<\/span><\/pre>\n
  44:<\/span> $errorActionPreference="Continue"<\/span><\/pre>\n
  45:<\/span>     <\/pre>\n
  46:<\/span> Write-Progress -Activity $activity -status "Calculating source port distribution"<\/span> -percentcomplete 40<\/pre>\n
  47:<\/span> $sourceport = $sniff | sort sourceport | group sourceport |sort count -descending | select Count,@{name="Port"<\/span>;Expression={$_.name}}<\/pre>\n
  48:<\/span>  <\/pre>\n
  49:<\/span> Write-Progress -Activity $activity -status "Calculating destination distribution"<\/span> -percentcomplete 50<\/pre>\n
  50:<\/span> $destinations = $sniff | sort destination | group destination | sort count -descending | select Count,@{name="IP"<\/span>;Expression={$_.name}}<\/pre>\n
  51:<\/span>  <\/pre>\n
  52:<\/span> Write-Progress -Activity $activity -status "Calculating destination port distribution"<\/span> -percentcomplete 60<\/pre>\n
  53:<\/span> $destinationport = $sniff | sort destport | group destport |sort count -descending | select Count,@{name="Port"<\/span>;Expression={$_.name}}<\/pre>\n
  54:<\/span>  <\/pre>\n
  55:<\/span> Write-Progress -Activity $activity -status "Presenting data"<\/span> -Completed $True -percentcomplete 100<\/pre>\n
  56:<\/span>  <\/pre>\n
  57:<\/span> #write results<\/span><\/pre>\n
  58:<\/span> write "NETWORK TRACE ANALYSIS"<\/span><\/pre>\n
  59:<\/span> write ("-"<\/span> * 50)<\/pre>\n
  60:<\/span> write `t<\/pre>\n
  61:<\/span> write $count<\/pre>\n
  62:<\/span> write $elapsed<\/pre>\n
  63:<\/span> write $packetsPerSecond<\/pre>\n
  64:<\/span> write `t<\/pre>\n
  65:<\/span> write "PROTOCOLS"<\/span><\/pre>\n
  66:<\/span> $protocols | Select Count,Protocol,@{Name="Percentage"<\/span>;Expression={"{0:P4}"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
  67:<\/span> write "DESTINATION IP"<\/span><\/pre>\n
  68:<\/span> $destinations | Select Count,IP,@{Name="Percentage"<\/span>;Expression={"{0:P4}"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
  69:<\/span> write "DESTINATION PORTS"<\/span><\/pre>\n
  70:<\/span> $destinationport | select Count,Port,@{Name="Percentage"<\/span>;Expression={"{0:P4}"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
  71:<\/span> write "SOURCE IP"<\/span><\/pre>\n
  72:<\/span> $sources | Select Count,IP,Host,@{Name="Percentage"<\/span>;Expression={"{0:P4}"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
  73:<\/span> write "SOURCE PORTS"<\/span><\/pre>\n
  74:<\/span> $sourceport | Select Count,Port,@{Name="Percentage"<\/span>;Expression={"{0:P4}"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
  75:<\/span>  <\/pre>\n<\/div>\n<\/div>\n<\/div>\n
The script takes a variable that holds the results of the Get-Packet script. I tried to come up with as many different views of the data as I could think of that might be relevant. There are break downs of packets by source ports, IP addresses and more. Because the analysis takes time, I used Write-Progress to provide feedback. This is a great cmdlet to use for long running tasks like this. Something else you might find useful from the script is code I use to resolve IP addresses to a host name using the System.Net.DNS class.<\/p>\n
\n
\n
   1:<\/span> $resolved=[system.Net.dns]::getHostEntry($ips[$i].Name).hostName <\/pre>\n<\/div>\n<\/div>\n
I turned off the error pipeline because if the method failed to resolved an IP address, it produced an error that halted the script.<\/p>\n
I recommend saving the results to a variable since this script may take several minutes or longer run depending on the size of your trace.<\/p>\n
PS C:\\> $report=c:\\scripts\\Analyze-packet.ps1 $sniff <\/font><\/p>\n
Here’s a truncated sample<\/a> of a report to give you an idea of what to expect. You could pipe $report to Out-File or Out-Printer. However, because it doesn’t output a single object it doesn’t lend itself to exporting or converting to an HTML file. I might come back to this at a later date and see if there are any alternatives. If you have suggestions, please let me know.<\/p>\n
\n
Download Analyze-Packet.ps1<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
If you’ve been trying out the Get-Packet script you’ve seen that there is a great deal of information. I wanted an easy way to analyze the data so I put together a script called Analyze-Packet that will slice and dice a saved network trace and produce a summary report.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[225,82,220,28,57],"class_list":["post-482","post","type-post","status-publish","format-standard","hentry","category-windows-powershell","tag-dns","tag-objects","tag-packet","tag-powershell","tag-scripting"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=482"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/482\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}