./wip/tcpxtract, Extract files from network traffic based on file signatures

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: CURRENT, Version: 1.0.1, Package name: tcpxtract-1.0.1, Maintainer: pkgsrc-users

tcpxtract is a tool for extracting files from network traffic based
on file signatures. Extracting files based on file type headers
and footers (sometimes called "carving") is an age old data recovery
technique. Tools like Foremost employ this technique to recover
files from arbitrary data streams. Tcpxtract uses this technique
specifically for the application of intercepting files transmitted
across a network. Other tools that fill a similar need are driftnet
and EtherPEG. driftnet and EtherPEG are tools for monitoring and
extracting graphic files on a network and is commonly used by
network administrators to police the internet activity of their
users. The major limitations of driftnet and EtherPEG is that they
only support three filetypes with no easy way of adding more. The
search technique they use is also not scalable and does not search
across packet boundries. tcpxtract features the following:

* Supports 26 popular file formats out-of-the-box. New formats
can be added by simply editing its config file.
* With a quick conversion, you can use your old Foremost config
file with tcpxtract.
* Custom written search algorithm is lightning fast and very scalable.
* Search algorithm searches across packet boundries for total
coverage and forensic quality.
* Can be used against a live network or a tcpdump formatted capture file.


Required to build:
[pkgtools/cwrappers]

Master sites:

RMD160: 0577bdaa1ab57457c805fb49376aa305ae4d9457
Filesize: 124.123 KB

Version history: (Expand)

CVS history: (Expand)


   2012-10-07 19:17:20 by Aleksej Saushev | Files touched by this commit (44) 
Log message:
Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.
Mark packages that don't or might probably not have staged installation.
   2009-10-11 12:45:10 by Thomas Klausner | Files touched by this commit (261) 
Log message:
Remove obsolete @dirrm lines.
   2009-03-21 16:25:44 by Kamel Derouiche | Files touched by this commit (1) 
Log message:
Added DESTDIR Support
   2008-02-06 20:33:59 by Sergey Svishchev | Files touched by this commit (1) 
Log message:
Unbreak packaging.
   2006-05-19 18:51:28 by Yoshito Komatsu | Files touched by this commit (95) 
Log message:
Replace tech-pkg@NetBSD.org with pkgsrc-users@NetBSD.org.
   2006-02-04 12:39:27 by Thomas Klausner | Files touched by this commit (5) | Imported package
Log message:
Initial import of tcpxtract-1.0.1:

tcpxtract is a tool for extracting files from network traffic based
on file signatures. Extracting files based on file type headers
and footers (sometimes called "carving") is an age old data recovery
technique. Tools like Foremost employ this technique to recover
files from arbitrary data streams. Tcpxtract uses this technique
specifically for the application of intercepting files transmitted
across a network. Other tools that fill a similar need are driftnet
and EtherPEG. driftnet and EtherPEG are tools for monitoring and
extracting graphic files on a network and is commonly used by
network administrators to police the internet activity of their
users. The major limitations of driftnet and EtherPEG is that they
only support three filetypes with no easy way of adding more. The
search technique they use is also not scalable and does not search
across packet boundries. tcpxtract features the following:

    * Supports 26 popular file formats out-of-the-box. New formats
      can be added by simply editing its config file.
    * With a quick conversion, you can use your old Foremost config
      file with tcpxtract.
    * Custom written search algorithm is lightning fast and very scalable.
    * Search algorithm searches across packet boundries for total
      coverage and forensic quality.
    * Can be used against a live network or a tcpdump formatted capture file.

TODO:
Doesn't work too well -- the extracted files have bogus
information inside. Mailed the author about it.