Chaosreader

A freeware tool to trace TCP/UDP/... sessions and fetch application data from snoop or tcpdump logs. This is a type of "any-snarf" program, as it will fetch telnet sessions, FTP files, HTTP transfers (HTML, GIF, JPEG, ...), SMTP emails, ... from the captured data inside network traffic logs. A html index file is created that links to all the session details, including realtime replay programs for telnet, rlogin, IRC, X11 and VNC sessions; and reports such as image reports and HTTP GET/POST content reports. Chaosreader can also run in standalone mode - where it invokes tcpdump or snoop (if they are available) to create the log files and then processes them.

This is a new summary site that links to further info. (gradually this may become Chaosreader's main home on the web).

Screenshots

• Chaosreader example output In this example, a snoop file was created while I loaded a website, used telnet to login, and ftp to transfer files; Chaosreader has managed to extract the HTTP sections, follow the telnet session, grab the FTP files, and create an Image Report from the snoop log. It has also created a replay program to playback the telnet session.

More screenshots here.

• http://chaosreader.sourceforge.net - (this) Summary site. links.
• http://sourceforge.net/projects/chaosreader - Latest version, older versions, change log.
• http://www.brendangregg.com/chaosreader.html - Latest version, documentation, more screenshots, troubleshooting.

chaosreader - latest version, older versions.

This has been tested on Solaris 9, RedHat 9 Linux and Windows 98.

Brendan Gregg
[Sydney, Australia]