Gathering information with more specific data from the packet, such as flags,num_failed_logins,su_attempted,diff srv rate and so on...

[gren...@gmail.com]

Hi, my name is Mike and im a student doing my master degree. I m searching for a librarry that can grant me information about the packet, but also about the connection provided when you connect such as -
duration protocol_type service flag src_bytes dst_bytes land wrong_fragment urgent hot num_failed_logins logged_in num_compromised root_shell su_attempted num_root num_file_creations num_shells num_access_files num_outbound_cmds is_host_login is_guest_login count srv_count serror_rate srv_serror_rate rerror_rate srv_rerror_rate same_srv_rate diff_srv_rate srv_diff_host_rate dst_host_count dst_host_srv_count dst_host_same_srv_rate dst_host_diff_srv_rate dst_host_same_src_port_rate dst_host_srv_diff_host_rate dst_host_serror_rate dst_host_srv_serror_rate dst_host_rerror_rate dst_host_srv_rerror_rate
Can your librarry help me with that?

[Boaz Brickner]

Using Pcap.Net you can get per packet information.

In order to get TCP connection statistics you'll need to follow the TCP connection by analyzing each TCP packet yourself.

I hope this helps,

Boaz.