Open Source Network Forensic Analysis Tool (NFAT) 

Twitter E-mail RSS

Xplico 0.7.1: DEFT Linux 7

We are pleased to announce the DEFT Linux 7 and the new release of Xplico.

Xplico 0.7.1 fixes some bugs:DEFT Linux 7

  • RTP bug fixed
  • dispatcher core functionality bug fixed
  • mfile manipulator bug fixed
  • XI bugs fixed
  • added DB migration tool

We are working to 1.0.0 version and you can try it here.

If you are a fun of Xplico, please vote for it 2011 Toolsmith Tool of the Year.

Enjoy!

CERT Linux Forensics Tools

Thanks to Larry Rogers the new release of Xplico can be downloaded from the CERT Linux Forensics Tools Repository. The RPM are available for Fedora 16, 15, 14 and 13.
The announcement says:

xplico-0.7.1-1.{fc13,fc14,fc15,fc16}.{i386,x86_64}.rpm – xplico is an Internet traffic decoder. See the Xplico website for the list of changes in this version. Note that RHEL/CentOS is not supported due to a lack of Python Version 3 support.

Enjoy!

Xplico 0.7.0: Gmail and language localization

This version introduces improvement on Webmail sniffing/decoding and the language localization.

The Earth seen from Apollo 17 (NASA)Changelog:

  • upgraded the XI to Cakephp 1.3
  • added the ICMPv6 dissector
  • Ethernet dissector improved (for ICMPv6)
  • one of two Xplico’s deadlock is solved
  • fixed the communication bug between xplico and the manipulators
  • SDP dissector bug fixed
  • SIP and TCP dissectors improved
  • WebMail manipulator and all Python3 scripts improved (ready to new webmail entry… see pol 😉 )
  • added pcap file name on CLI report
  • capture modules log improved
  • new GeoIP version: 1.4.8
  • added IPv6 Hop-by-Hop options
  • Xplico and all Manipulators with dual stack (IPv4, IPv6)
  • XI language localization (each fix is ​​well come): Arabic, Chinese, German, English, French, Hindi, Italian, Japanese, Portuguese, Russian, Spanish, Turkish
  • DNS bug fixed
  • added the MDNS dissector
  • added AOL WebMail
  • added Yahoo! WebMail
  • added Yahoo! Mail for Andorid Mobile
  • added Gmail

We thank:

  • briaeros007 (member of the forum) for his test about IPv6 functionality on Xplico’s applications
  • James Fisher, he has found and fixed a bug in the HTTP dissector

Enjoy Xplico!

Web Demo

We are completing the tests on 0.7.0 version. In this release the main features are:

  • Gmail Webmail (HTTP)
  • Yahoo! Mobile Mail (Andorid)
  • AOL WebMail (last version)
  • Language localization

WebDemo
The “WebMail sniffer” component (manipulator and python scripts) were improved.
All this features and others can be  examined and tested with the Web Demo of Xplico.
Any help on Language translation and bug report or suggestions are greatly appreciated.
In the Web Demo all data can be remove by you, in anyway all data (but not the users accounts) are removed every day at 00:00 UTC. More info about Web Demo can be found here.

Network Probes and Xplico

As many Xplico users know, the Xplico “Live capture” is not the great solution to capture the network traffic. The “Live capture” was introduced only for the purpose of demonstration and it can not be considered a proper mode to capture network data.
From 0.6.2 version we have improved the “real time capture” (=> Live capture), but these improvements have not solved (and can not solve) some limits (deliberately) imposed on Xplico. Currently, the real time capture is performed by a plug-in (module) belonging to the Xplico capture modules and not from a separate application. This capture module uses the libpcap to capture data from the network adapter.
In this context Xplico can lose data (packets) for two reasons:

  • real-time capture module is not designed to hi speed network traffic
  • the Xplico I/O monitoring: the Xplico (decoder) controls the memory/threads/data used and, as feedback, it imposes a slowing of incoming data (with the capture module). If the input data is a pcap file there are no consequences, but if the input is the network card then we can lose the data.

How to solve this problem? Simple, using applications (or/and hardware) designed specifically for this purpose, that of Network Probes. We want to mention here two projects that have as their objective the capture of high network traffic data and use techniques that minimize the likelihood of data loss.

The first one is n2disk of our friend Luca Deri. n2disk is based on PF_RING. PR_RING is also used in nProbe and it is what provides the high performance at nProbe.

The second project is net-sniff-ng and it is developed by Daniel Borkmann and Emmanuel Roullit.The main features of net-sniff-ng:

  • it is completely open source (GPLv2)
  • its main goal is to be a high performance network sniffer
  • it uses ‘zero-copy’ mechanisms
  • Berkeley Packet Filter to the socket in order to pre-filter traffic within the kernel

If you are interested in trying netsniff-ng with Xplico what you have to do is:

  • download netsniff-ng from the git repository (remember that netsniff-ng is in continuous development)
  • copy netsniff-ng-xplico file in netsniff-ng/src/netsniff-ng.c

  • cd netsniff-ng/src/netsniff-ng
    make
    sudo make install
    /opt/xplico/script/session_mng.pyc -n netsniff test

    use the session_mng.pyc output:


    Put the pcap files here: /opt/xplico/pol_1/sol_1/new

    in the next command

    sudo netsniff-ng --in eth0 --out dump.pcap --silent --dump-path /opt/xplico/pol_1/sol_1/new --dump-frequency 10

Enjoy.

Fedora 11-15, CentOS/RHEL repositories and VirtualBox

Lawrence R. Rogers has built and released Xplico 0.6.3 for Fedora 11, 12, 13, 14, 15 and CentOS/RHEL . You can find it at the CERT Linux Forensics Tools Repository.
Carlos Gacimartín has built the VirtualBox image with Xplico 0.6.3. You can find it here.

Xplico 0.6.3: 64Bit

In this release:

  • 32 and 64 bit
  • new decoding manager (DeMa): version 0.3.1
  • mfile manipulator (HTTP file transfer) bug fixes
  • WebMail scripts improved
  • HTTP dissector improved
  • XI: upgraded the javascript libraries

Enjoy !

ISSA Journal: toolsmith

Russ McRee wrote an article about Xplico for ISSA Journal.
The PDF file can be downloaded here.

The next week will be released the Xplico’s new version, with support for 64bit.

WebMail decoder… which do you prefer?

We are adding new WebMail decoder to Xplico, but since there are a large number of WebMail on the web, we ask for your advice.

What are the WebMail to add to Xplico?

  • Google Mail: HTTP GMail (30%, 77 Votes)
  • Yahoo! Mobile (18%, 46 Votes)
  • GMX: www.gmx.net (Germany) (10%, 25 Votes)
  • Rouncube: roundcube.net (9%, 24 Votes)
  • Horde: www.horde.org (9%, 23 Votes)
  • 163: www.163.com (China) (9%, 23 Votes)
  • Orange: webmail.orange.fr (France) (7%, 19 Votes)
  • Libero: www.libero.it (Italy) (3%, 8 Votes)
  • Rediff: www.rediff.com (India) (2%, 6 Votes)
  • MYNET: mynet.com (Turkey) (2%, 4 Votes)
  • TTNET: www.ttnet.com.tr (Turkey) (1%, 3 Votes)

Total Voters: 199

Loading ... Loading ...

You can comment this post to add new webmail (not in the poll). In the comment specify:

  • The service name
  • WebMail URL
  • Nationality

We will add your proposal in the poll.

Xplico 0.6.2: l7-patterns

This version introduces l7-patterns classifier for all flows not decoded, also there is the improvement of the real time acquisition, new features for the XI (Xplico Interface) and many bugs fixes.

ChangeLog:

  • l7-patterns for all flows/protocols not decoded by xplico
  • Xplico Interface (XI) improved
  • python3 porting of many scripts
  • realtime capture module improved
  • facebook chat realtime view
  • UTC/localtime bug fixes
  • l2tp dissector bug fixes
  • cli and lite dispatchers bug fixes
  • telnet dissector bug fixes
  • trigcap bug fixes
  • new script named session_mng.pyc to facilitate the creation of new case and/or new session from command line

We thank naif for his support and his availability.


The decoding performance are:

  • from command line: 5.9 MB/s
  • from Xplico Interface (XI) with SQLite DB (=> lite dispatcher): 1.76 MB/s
  • from Xplico Interface with MySQL DB (=> ximysql dispatcher): 4.09 MB/s

measured on an Aspire 5633WLMi (Intel Core 2 Duo processor T5500 with 1GB RAM an HD IDE controller) with the pcap http://domex.nps.edu/corp/scenarios/2009-m57/net/day11-18.dmp.zip (851 MB).

As always: Enjoy !