{"id":612,"date":"2008-08-14T12:00:11","date_gmt":"2008-08-14T20:00:11","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/2008\/08\/14\/analyze-packet-reloaded\/"},"modified":"2008-08-14T12:00:11","modified_gmt":"2008-08-14T20:00:11","slug":"analyze-packet-reloaded","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2008\/08\/14\/analyze-packet-reloaded\/","title":{"rendered":"Analyze-Packet Reloaded"},"content":{"rendered":"

While getting caught up on my podcast back log I was listening to an episode of Mind of Root<\/a>. In it Steven Murawski<\/a> mentioned my Get-Packet<\/a> and Analyze-Packet<\/a> PowerShell scripts. One of his (legitimate) issues with Analyze-Packet was the way it presented results. The original version simply wrote information to the console. It didn’t use a good object model so that you could format the results the way you wanted. I took this as a challenge to improve the script. Here is a new improved version of Analyze-Packet with some additional improvements from Steven<\/a>.<\/p>\n

\n
\n
   1:<\/span> Param([object]$sniff =$(throw<\/span> 'USAGE: Analyze-Packet -Sniff (result of Get-Packet script) [-NoResolution]'<\/span>), [switch<\/span>]$NoResolution)<\/pre>\n
   2:<\/span>  <\/pre>\n
   3:<\/span>  <\/pre>\n
   4:<\/span> #Changed by Steven Murawski 08\/14\/08<\/span><\/pre>\n
   5:<\/span> #Refactored common code from DNS lookup for source and destination IPs<\/span><\/pre>\n
   6:<\/span> function<\/span> ResolveIPAddress([string]$status, [Object[]]$IPAdresses )<\/pre>\n
   7:<\/span> {<\/pre>\n
   8:<\/span>     #turn off errors to prevent the script from halting if an IP can't be resolved<\/span><\/pre>\n
   9:<\/span>     $errorActionPreference=\"SilentlyContinue\"<\/span><\/pre>\n
  10:<\/span>     <\/pre>\n
  11:<\/span>     $hosts = @()<\/pre>\n
  12:<\/span>     <\/pre>\n
  13:<\/span>     for<\/span> ($i=0;$i -lt<\/span> $IPAdresses.count;$i++) <\/pre>\n
  14:<\/span>     {     <\/pre>\n
  15:<\/span>         Write-Progress -Activity $activity -status $status -currentoperation $IPAdresses[$i].IP -percentcomplete (($i\/$IPAdresses.count)*100)<\/pre>\n
  16:<\/span>         Write-Debug $IPAdresses[$i].IP<\/pre>\n
  17:<\/span>         <\/pre>\n
  18:<\/span>         $resolved = [system.Net.dns]::getHostEntry($IPAdresses[$i].IP)<\/pre>\n
  19:<\/span>         <\/pre>\n
  20:<\/span>         if<\/span> ($resolved.HostName) <\/pre>\n
  21:<\/span>         {<\/pre>\n
  22:<\/span>             $resolvedhost=$resolved.hostname<\/pre>\n
  23:<\/span>         }<\/pre>\n
  24:<\/span>         else<\/span> <\/pre>\n
  25:<\/span>         {<\/pre>\n
  26:<\/span>             $resolvedhost=$IPAdresses[$i].IP<\/pre>\n
  27:<\/span>         }<\/pre>\n
  28:<\/span>         <\/pre>\n
  29:<\/span>         $obj=New-Object PSObject<\/pre>\n
  30:<\/span>  <\/pre>\n
  31:<\/span>         $obj | Add-Member -MemberType Noteproperty -name \"Count\"<\/span> -value $IPAdresses[$i].Count<\/pre>\n
  32:<\/span>         $obj | Add-Member -MemberType Noteproperty -name \"IP\"<\/span> -value $IPAdresses[$i].IP<\/pre>\n
  33:<\/span>         $obj | Add-Member -MemberType Noteproperty -name \"Host\"<\/span> -value $resolvedhost<\/pre>\n
  34:<\/span>         <\/pre>\n
  35:<\/span>         $hosts+=$obj<\/pre>\n
  36:<\/span>         <\/pre>\n
  37:<\/span>         #reset $resolved<\/span><\/pre>\n
  38:<\/span>         Remove-Variable resolved<\/pre>\n
  39:<\/span>         <\/pre>\n
  40:<\/span>         <\/pre>\n
  41:<\/span>     }<\/pre>\n
  42:<\/span>     #turn error pipeline back on. Not really necessary because of scop<\/span><\/pre>\n
  43:<\/span>     #but including for consistency<\/span><\/pre>\n
  44:<\/span>     <\/pre>\n
  45:<\/span>     $errorActionPreference=\"Continue\"<\/span><\/pre>\n
  46:<\/span>     $hosts<\/pre>\n
  47:<\/span> }<\/pre>\n
  48:<\/span>  <\/pre>\n
  49:<\/span> #main body of script<\/span><\/pre>\n
  50:<\/span>  <\/pre>\n
  51:<\/span> $activity=\"Analyzing network trace\"<\/span><\/pre>\n
  52:<\/span> Write-Progress -Activity $activity -status \"Counting packets\"<\/span> -percentcomplete 1<\/pre>\n
  53:<\/span> $count = $sniff.count<\/pre>\n
  54:<\/span>  <\/pre>\n
  55:<\/span> Write-Progress -Activity $activity -status \"Calculating elapsed time\"<\/span> -percentcomplete 5<\/pre>\n
  56:<\/span> $elapsed = $sniff[-1].time -$sniff[0].time<\/pre>\n
  57:<\/span>  <\/pre>\n
  58:<\/span> #calculate packets per second<\/span><\/pre>\n
  59:<\/span> $pps = $sniff.count\/(($sniff[-1].time -$sniff[0].time).totalseconds)<\/pre>\n
  60:<\/span> $pps=\"{0:N4}\"<\/span> -f $pps<\/pre>\n
  61:<\/span>  <\/pre>\n
  62:<\/span> Write-Progress -Activity $activity -status \"Calculating protocol distribution\"<\/span> -percentcomplete 20<\/pre>\n
  63:<\/span> $protocols = $sniff | sort protocol | group protocol | sort count -descending | select Count,@{name=\"Protocol\"<\/span>;Expression={$_.name}} <\/pre>\n
  64:<\/span>  <\/pre>\n
  65:<\/span> Write-Progress -Activity $activity -status \"Calculating source port distribution\"<\/span> -percentcomplete 40<\/pre>\n
  66:<\/span> $sourceport = $sniff | sort sourceport | group sourceport |sort count -descending | select Count,@{name=\"Port\"<\/span>;Expression={$_.name}}<\/pre>\n
  67:<\/span>  <\/pre>\n
  68:<\/span> Write-Progress -Activity $activity -status \"Calculating destination distribution\"<\/span> -percentcomplete 50<\/pre>\n
  69:<\/span> $destinationlist=$sniff | sort Destination | select Destination<\/pre>\n
  70:<\/span>  <\/pre>\n
  71:<\/span> Write-Progress -Activity $activity -status \"Calculating destination port distribution\"<\/span> -percentcomplete 60<\/pre>\n
  72:<\/span> $destinationport = $sniff | sort destport | group destport |sort count -descending | select Count,@{name=\"IP\"<\/span>;Expression={$_.name}}<\/pre>\n
  73:<\/span>  <\/pre>\n
  74:<\/span> Write-Progress -Activity $activity -status \"Building source list\"<\/span> -percentcomplete 30<\/pre>\n
  75:<\/span> $sourcelist = $sniff | sort source | select Source<\/pre>\n
  76:<\/span>  <\/pre>\n
  77:<\/span> Write-Progress -Activity $activity -status \"Building source IP list\"<\/span> -percentcomplete 35<\/pre>\n
  78:<\/span> $ips = $sourcelist| group source |sort count -descending | select Count,@{Name=\"IP\"<\/span>;Expression={$_.Name}} <\/pre>\n
  79:<\/span>  <\/pre>\n
  80:<\/span>  <\/pre>\n
  81:<\/span> $sources = $null<\/pre>\n
  82:<\/span>  <\/pre>\n
  83:<\/span> if<\/span> ($NoResolution)<\/pre>\n
  84:<\/span> {<\/pre>\n
  85:<\/span>     $sources = $ips<\/pre>\n
  86:<\/span> }<\/pre>\n
  87:<\/span> else<\/span> <\/pre>\n
  88:<\/span> {<\/pre>\n
  89:<\/span>     $sources = ResolveIPAddress 'Resolving Source IP addresses'<\/span> $ips<\/pre>\n
  90:<\/span> }<\/pre>\n
  91:<\/span>  <\/pre>\n
  92:<\/span> Write-Progress -Activity $activity -status \"Build destination IP list\"<\/span> -percentcomplete 35<\/pre>\n
  93:<\/span> $ipd = $destinationlist| group destination |sort count -descending | select Count,@{Name=\"IP\"<\/span>;Expression={$_.Name}} <\/pre>\n
  94:<\/span>  <\/pre>\n
  95:<\/span> $destinations = $null<\/pre>\n
  96:<\/span>  <\/pre>\n
  97:<\/span> if<\/span> ($NoResolution)<\/pre>\n
  98:<\/span> {<\/pre>\n
  99:<\/span>     $destinations = $ipd<\/pre>\n
 100:<\/span> }<\/pre>\n
 101:<\/span> else<\/span> <\/pre>\n
 102:<\/span> {<\/pre>\n
 103:<\/span>     $destinations = ResolveIPAddress 'Resolving Destination IP addresses'<\/span> $ipd<\/pre>\n
 104:<\/span> }<\/pre>\n
 105:<\/span>   <\/pre>\n
 106:<\/span> Write-Progress -Activity $activity -status \"Presenting data\"<\/span> -Completed $True -percentcomplete 100<\/pre>\n
 107:<\/span>  <\/pre>\n
 108:<\/span> $protocols       = $protocols | Select Count,Protocol,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
 109:<\/span>  <\/pre>\n
 110:<\/span> $destinationport = $destinationport | select Count,Port,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
 111:<\/span>  <\/pre>\n
 112:<\/span> $sourceport      = $sourceport | Select Count,Port,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
 113:<\/span>  <\/pre>\n
 114:<\/span> if<\/span> ($NoResolution)<\/pre>\n
 115:<\/span> {<\/pre>\n
 116:<\/span>     $destinations    = $destinations | Select Count,IP,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
 117:<\/span>     $sources         = $sources | select Count,IP,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}}     <\/pre>\n
 118:<\/span> }<\/pre>\n
 119:<\/span> else<\/span><\/pre>\n
 120:<\/span> {<\/pre>\n
 121:<\/span>     $destinations    = $destinations | Select Count,IP,Host,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
 122:<\/span>     $sources         = $sources | Select Count,IP,Host,@{Name=\"Percentage\"<\/span>;Expression={\"{0:P4}\"<\/span> -f ($_.count\/$sniff.count)}} <\/pre>\n
 123:<\/span> }<\/pre>\n
 124:<\/span>     <\/pre>\n
 125:<\/span> #write results to a custom object<\/span><\/pre>\n
 126:<\/span> $results=New-Object PSobject<\/pre>\n
 127:<\/span>  <\/pre>\n
 128:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"TotalPackets\"<\/span> -Value $sniff.count<\/pre>\n
 129:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"Elapsedtime\"<\/span> -Value $elapsed<\/pre>\n
 130:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"PacketsPerSec\"<\/span> -Value $pps<\/pre>\n
 131:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"Protocols\"<\/span> -value $protocols<\/pre>\n
 132:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"Destinations\"<\/span> -value $destinations<\/pre>\n
 133:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"DestinationPorts\"<\/span> -value $destinationport<\/pre>\n
 134:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"Sources\"<\/span> -value $sources<\/pre>\n
 135:<\/span> $results | Add-Member -MemberType Noteproperty -Name \"SourcePorts\"<\/span> -value $sourceport <\/pre>\n
 136:<\/span>  <\/pre>\n
 137:<\/span> write $results<\/pre>\n<\/div>\n<\/div>\n
The new version includes a switch parameter to disable name resolution. By default the script will attempt to resolve host names from IP addresses which is what I prefer. But there may be times when you don’t want to resolve names which will speed up analysis considerably. In those instances use -NoResolution.  Of course, you can modify the script to make this the default and use the switch to enable name resolution.<\/p>\n
During testing and development I also found an issue with the way I was getting and stored IP addresses. I was having problems when using a network capture re-hydrated from an XML file. The export file was storing an IP object when all I really wanted was the IP address as a string.  I went back and modified Get-Packet and now you can use its results with this version of Analyze-Packet.<\/p>\n
The main addition to Analyze-Packet is that it writes a single object to the pipeline. Some of the property values are nested objects. For example, the Protocols property is an embedded object with properties Count,Protocol and Percentage:<\/p>\n
Count Protocol                                Percentage
—– ——–                                ———-
22353 TCP                                     98.4670 %
  316 UDP                                     1.3920 %
   32 ICMP                                    0.1410 %<\/font><\/p>\n
Other PowerShell objects use do this so I figured I would as well. Here’s an example of what this looks like and how you might use it.<\/p>\n
PS C:\\test> $report=c:\\scripts\\posh\\analyze-packet $sniff
PS C:\\test> $report <\/font><\/p>\n
TotalPackets     : 22701
Elapsedtime      : 00:23:16.7070473
PacketsPerSec    : 16.2532
Protocols        : {@{Count=22353; Protocol=TCP; Percentage=98.4670 %}, @{Count=316; Protocol=UDP; Percentage=1.3920 %}
                   , @{Count=32; Protocol=ICMP; Percentage=0.1410 %}}
Destinations     : {@{Count=22556; IP=172.16.10.102; Host=172.16.10.102; Percentage=99.3613 %}, @{Count=78; IP=255.255.
                   255.255; Host=255.255.255.255; Percentage=0.3436 %}, @{Count=61; IP=172.16.255.255; Host=172.16.255.
                   255; Percentage=0.2687 %}, @{Count=6; IP=224.0.0.252; Host=224.0.0.252; Percentage=0.0264 %}}
DestinationPorts : {@{Count=2453; Port=; Percentage=10.8057 %}, @{Count=2424; Port=; Percentage=10.6779 %}, @{Count=240
                   0; Port=; Percentage=10.5722 %}, @{Count=2337; Port=; Percentage=10.2947 %}…}
Sources          : {@{Count=2497; IP=208.117.234.45; Host=mia-v148.mia.youtube.com; Percentage=10.9995 %}, @{Count=2453
                   ; IP=74.125.15.20; Host=74.125.15.20; Percentage=10.8057 %}, @{Count=2424; IP=208.117.234.177; Host=
                   mia-v228.mia.youtube.com; Percentage=10.6779 %}, @{Count=2400; IP=74.125.15.36; Host=74.125.15.36; P
                   ercentage=10.5722 %}…}
SourcePorts      : {@{Count=18032; Port=80; Percentage=79.4326 %}, @{Count=2552; Port=445; Percentage=11.2418 %}, @{Cou
                   nt=618; Port=3000; Percentage=2.7223 %}, @{Count=308; Port=2492; Percentage=1.3568 %}…} <\/font><\/p>\n
PS C:\\test> $report.destinations <\/font><\/p>\n
                        Count IP                            Host                          Percentage
                        —– —                            —-                          ———-
                        22556 172.16.10.102                 172.16.10.102                 99.3613 %
                           78 255.255.255.255               255.255.255.255               0.3436 %
                           61 172.16.255.255                172.16.255.255                0.2687 %
                            6 224.0.0.252                   224.0.0.252                   0.0264 % <\/font><\/p>\n
PS C:\\test> $report.sources | select -first 5 <\/font><\/p>\n
                        Count IP                            Host                          Percentage
                        —– —                            —-                          ———-
                         2497 208.117.234.45                mia-v148.mia.youtube.com      10.9995 %
                         2453 74.125.15.20                  74.125.15.20                  10.8057 %
                         2424 208.117.234.177               mia-v228.mia.youtube.com      10.6779 %
                         2400 74.125.15.36                  74.125.15.36                  10.5722 %
                         2337 64.15.113.36                  lax-v253.lax.youtube.com      10.2947 % <\/font><\/p>\n
PS C:\\test> $report.sourceports | select -first 5 <\/font><\/p>\n
                                  Count Port                                    Percentage
                                  —– —-                                    ———-
                                  18032 80                                      79.4326 %
                                   2552 445                                     11.2418 %
                                    618 3000                                    2.7223 %
                                    308 2492                                    1.3568 %
                                    305 143                                     1.3436 % <\/font><\/p>\n
PS C:\\test><\/font> <\/p>\n
While these  packet scripts may not find much production use, I hope they provide examples of scripting techniques especially the use of custom objects, custom properties, Write-Progress and functions.  If you have additional suggestions, please leave a comment and  let me know.<\/p>\n
\n
Download a zip file with both updated scripts here<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
While getting caught up on my podcast back log I was listening to an episode of Mind of Root. In it Steven Murawski mentioned my Get-Packet and Analyze-Packet PowerShell scripts. One of his (legitimate) issues with Analyze-Packet was the way it presented results. The original version simply wrote information to the console. It didn’t use a good object model so that you could format the results the way you wanted. I took this as a challenge to improve the script.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[223,225,274,242,220,28,57,276,275],"class_list":["post-612","post","type-post","status-publish","format-standard","hentry","category-windows-powershell","tag-add-member","tag-dns","tag-network-trace","tag-new-object","tag-packet","tag-powershell","tag-scripting","tag-sniff","tag-write-progress"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=612"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/612\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}