xtractr is a hybrid cloud application for indexing, searching, reporting, extracting and collaborating on pcaps. This enables you to rapidly identify field issues and perform network forensics and troubleshooting with just a few clicks. This lite version of xtractr can index up to 10 million packets or 1 Gbyte of pcaps.

While xtractr can be used as a standalone application, it works best with Mu Studio to convert the problematic conversation into a stateful test case.

Blog: Network Forensics in IRB: xtractr Ruby Gem

While we could list out all the cool things you could do with xtractr, we figured you can just try it out and see for yourself. xtractr is built for the cloud and is fully RESTful so you can use your browser to analyze the packets. We indexed #4 of the Forensics Challenge (VoIP) from honeynet.org using xtractr. Can you answer the forensics questions? Start Live Demo! 504,401,630 packets processed so far.

Download xtractr, a linux executable, untar it and install it on say, /usr/local/bin/. Make sure that this is in your PATH.

You must be logged in to download xtractr!

Index

xtractr can index just a single pcap or a collection of them in one go. It uses tshark to extract various information about each packet, but adds flow classification to group the packets into logical conversations. So the only key requirement is that you have Wireshark installed on the host that you are planning to use xtractr on. Assuming you have a directory foo with a bunch of pcaps, you can index them like so:

Make sure you have have enough disk space! xtractr trades off disk space for faster search, extract and report. In forensics mode, the index size will typically be much larger than the actual pcap size.

Explore

Tired of remembering command-line kung-fu? xtractr helps you get to the packet or content you care about with contextual queries and instant reports. Fully visual and interactive, xtractr harnesses the power of the browser to unravel information tucked away in your packet captures.

Once you have indexed a set of pcaps, simply start xtractr in browse mode and point it to the index:

xtractr has an embedded web server that by default binds to http://localhost:8080. You can change this by using the --host and --port options. Now point your favorite browser to http://localhost:8080 and voilá.

Compatibility

xtractr is known to work with most modern Linux distros. Supported browsers include Chrome, FireFox and Safari. IE 7/8 kinda/sorta works, but we are actively looking into supporting these. If you want us to support your favorite browser contact us either using the Feedback form on the right or the pcapr forum.

Nuggets are community contributed queries and reports to help you find what you are looking for without having to learn the query language. The queries, stored and tagged on pcapr, are applied against your xtractr index. Your data stays with you.

• Top HTTP Content Show the unique list of HTTP content types jschmidt February 2010 343 hits

• Top Bandwidth Hoggers (bytes) for HTTP Show the top HTTP bandwidth hoggers based on the total bytes sent and received mu February 2010 271 hits

• Top TCP Destination Ports that were scanned Show the top TCP destination ports that we potentially port scanned (no messages in the conversation) mu February 2010 168 hits

• Top Destination Ports for Unknown TCP Services Show top TCP destination ports for flows that don't map to a service mu February 2010 96 hits

• Min/Max HTTP Transaction Times Show URL's ordered by how long it took for the server to process them mu February 2010 158 hits

• HTTP connections/second Show a graph of HTTP connections/second mu January 2010 161 hits

• HTTP Slow Response Show URL's that take longer than 1 second mu January 2010 112 hits

• Top Web Browsers Show the unique list of web browsers mu January 2010 142 hits

• Top HTTP methods Show the unique list of HTTP methods mu January 2010 99 hits

• Top DNS queries that timed out Show all the DNS queries that didn't receive any response mu January 2010 117 hits

Do I have to upload my pcap to the cloud?

Are all my search queries stored on the cloud?

Where are my labels stored?

Can more than one person be looking at the index?

Can I look at more than one index at a time?