over-the-wire
Version:
Network inspection library for Node
153 lines (129 loc) • 6.07 kB
Markdown
HTTP Traffic Analyzer
=====================
This application analyzes HTTP traffic and presents detailed and diverse information about it such as:
- Packet count and rate
- Bandwidth
- Flow count and rate
- HTTP requests + responses count and rate
- HTTP transaction count and rate
- HTTP pipelining count
- HTTP header size
- Hostname histogram
- Content-type histogram
- Status code histogram
It can analyze live traffic or read packets from a pcap/pcap-ng file
The output stats looks as follows:
STATS SUMMARY
=============
General stats
--------------------
Sample time: 18.374 [Seconds]
Number of HTTP packets: 5662 [Packets]
Rate of HTTP packets: 291.910 [Packets/sec]
Number of HTTP flows: 55 [Flows]
Rate of HTTP flows: 2.836 [Flows/sec]
Number of HTTP pipelining flows: 0 [Flows]
Number of HTTP transactions: 322 [Transactions]
Rate of HTTP transactions: 16.601 [Transactions/sec]
Total HTTP data: 5916120 [Bytes]
Rate of HTTP data: 305011.600 [Bytes/sec]
Average packets per flow: 102.945 [Packets]
Average transactions per flow: 5.963 [Transactions]
Average data per flow: 107565.818 [Bytes]
HTTP request stats
--------------------
Number of HTTP requests: 323 [Requests]
Rate of HTTP requests: 16.653 [Requests/sec]
Total data in headers: 188596 [Bytes]
Average header size: 583.889 [Bytes]
HTTP response stats
--------------------
Number of HTTP responses: 332 [Responses]
Rate of HTTP responses: 17.117 [Responses/sec]
Total data in headers: 119577 [Bytes]
Average header size: 360.172 [Bytes]
Num of responses with content-length: 320 [Responses]
Total body size (may be compressed): 5409410 [Bytes]
Average body size: 16904.406 [Bytes]
HTTP request methods
--------------------
| Method | Count |
---------------------
| GET | 321 |
| POST | 2 |
---------------------
Hostnames count
--------------------
| Hostname | Count |
----------------------------------------------------
| images1.teny.co.qq | 180 |
| www.teny.co.qq | 82 |
| go.teny.co.qq | 14 |
| www.niwwin.co.qq | 8 |
| az835984.vo.msecnd.net | 5 |
| asset.pagefair.com | 3 |
| b.scorecardresearch.com | 3 |
| cdn.oolala.com | 3 |
| asset.pagefair.net | 2 |
| dy2.teny.co.qq | 2 |
| ecdn.firstimpression.io | 2 |
| pagead2.googlesyndication.com | 2 |
| server.exposebox.com | 2 |
| totalmedia2.teny.co.qq | 2 |
| vrp.mybrain.com | 1 |
| trc.oolala.com | 1 |
| zdwidget3-bs.sphereup.com | 1 |
| vrt.mybrain.com | 1 |
| www.googletagmanager.com | 1 |
| a.visualrevenue.com | 1 |
| tpc.googlesyndication.com | 1 |
| static.dynamicyield.com | 1 |
| st.dynamicyield.com | 1 |
| sf.exposebox.com | 1 |
| mediadownload.teny.co.qq | 1 |
| cdn.firstimpression.io | 1 |
| ajax.googleapis.com | 1 |
----------------------------------------------------
Status code count
--------------------
| Status Code | Count |
----------------------------------------
| 200 OK | 327 |
| 204 No Content | 1 |
| 301 Moved Permanently | 1 |
| 302 Moved Temporarily | 1 |
| 304 Not Modified | 2 |
----------------------------------------
Content-type count
--------------------
| Content-type | Count |
------------------------------------------
| application/javascript | 11 |
| application/json | 1 |
| application/x-javascript | 23 |
| image/gif | 22 |
| image/jpeg | 157 |
| image/png | 85 |
| text/css | 9 |
| text/html | 8 |
| text/javascript | 13 |
------------------------------------------
Using the utility
-----------------
When analyzing HTTP traffic from a pcap/pcap-ng file:
Basic usage:
HttpAnalyzer [-h] -f input_file
Options:
-f : The input pcap file to analyze. Required argument for this mode
-h : Displays this help message and exits
When analyzing HTTP traffic on live traffic:
Basic usage:
HttpAnalyzer [-hld] [-o output_file] [-r calc_period] [-p dst_port] -i interface
Options:
-i interface : Use the specified interface. Can be interface name (e.g eth0) or interface IPv4 address
-p dst_port : Use the specified port (optional parameter, the default is 80)
-o output_file : Save all captured HTTP packets to a pcap file. Notice this may cause performance degradation
-r calc_period : The period in seconds to calculate rates. If not provided default is 2 seconds
-d : Disable periodic rates calculation
-h : Displays this help message and exits
-l : Print the list of interfaces and exists