As part of the tidy up, I also want to replace all instances of
awk -F' '
with
awk -F '\t'
The former is quicker and easier to type (which is why I've been using it), but leaves too much room for mistakes (copying and pasting between editors might convert to spaces, for example). The latter is also easier to see for what it is in any format that doesn't have syntax highlighting
I've tidied up the stdout output a bit, and made things a bit more verbose:
Starting, using /tmp/pcapanalysis.27514 for temp files
Processing PCAP
Extracting a list of Destination Ports
Analysing Port 80 Traffic
Analysing SSL/TLS traffic
Extracting Mail related traffic
Correlating information
Identifying HTTPS pages from HTTP Referrers
Looking for interesting referers
Looking for interesting paths
Looking for XMPP traffic
Building reports
Processing webtraffic.csv
Building list of known IPs
Building cookie list
Building User-agent list
Building FQDN list
Building Credential List
Building list of httpspaths - httpspaths.csv
Building IP/Port list - dest-ip-ports.csv
Creating interesting URLs list
Extracting interesting cookies
Building xmpppeers.csv
Building mailtransactions.csv
Done- Reports in report.example-split.pcap3.1448633576
Activity
2015-11-26 13:19:12
2015-11-26 13:19:48
Webhook User-Agent
View Commit
2015-11-27 13:41:38
with
The former is quicker and easier to type (which is why I've been using it), but leaves too much room for mistakes (copying and pasting between editors might convert to spaces, for example). The latter is also easier to see for what it is in any format that doesn't have syntax highlighting
2015-11-27 14:18:31
2015-11-27 14:19:44
Webhook User-Agent
View Commit
2016-02-03 13:34:23
I've stripped out the literal tabs and replaced with "\t". Test run going at the moment.
2016-02-03 13:47:32
Webhook User-Agent
View Commit
2016-02-03 13:47:33
Webhook User-Agent
View Commit