Thanks.Some notes and another question:
Using tcpflow for windows (downloaded from http://www.digitalcorpora.org/downloads/tcpflow/) I see significant differents between the output of the 64bit version and the 32bit version, on the same pcap file with the same command.The command:tcpflow32.exe -a -r test.pcap -o .\tc32andtcpflow64.exe -a -r test.pcap -o .\tc64yields completely different output:
- There is only 1 HTTPBODY file for each response flow in the 32bit version (in the 64bit ver there are many file, depends on the responses number). that could be explained by the different version (1.3.0 for 32bit and 1.4.0_a2 for 64bit)
- When I compare the same flow files between the two version i see great differents. for example- in the 32bit version there are 31 requests in one file while in the 64bit version there are only 2 requests (which included also in the 32bit file) on the same file.Take the above into account i want to write a python script that builds request-response files from the 32bit version output.My question is:If there is no response for some requests (due to, for example, network error)- could I see it in the flow file which contains the server responses?Tahnk you very much
On Saturday, October 5, 2013 11:23:51 PM UTC+3, SLG wrote:Great. Glad you got it.
On Oct 5, 2013, at 3:00 PM, tcpflow user <tcpflo...@gmail.com> wrote:
> I made a mistake in the previous quastion and i write it here for other useres. the numbers at the end of "HTTPBODY" file are not a connection number but sequaence numbers.
> a cursory glance at the files shows that the sequence is match the requests sequence (hopefully. that is what I want to know, and therfore I opened this post)