LPI_PROTOIDENT(1)

okay so bestie, welcome to LPI_PROTOIDENT(1) — the User Commands manual page for the little tool that snitches on your network flows 💅✨. It's giving packet-trace detective, and honestly? iconic.

✨ NAME ✨

lpi_protoident — literally lists the application protocol of all network flows in a trace, periodt. 💖

🦋 SYNOPSIS 🦋

lpi_protoident inputuri

🌸 DESCRIPTION 🌸

This tool tries to identify each individual flow inside the network packet trace you hand it, plus the application protocol that flow is using, all via the libprotoident traffic classification library. No cap. 🫶

Important vibe check: identification only happens when the flow has concluded or expired due to inactivity. So it is not very effective for real-time use cases — don't come for this tool expecting live updates, bestie. 😭

The inputuri argument must be a valid libtrace URI. That's the rule. 🎀

🎀 OUTPUT FORMAT 🎀

For every flow discovered in the input trace, a single line gets printed to stdout describing that flow. Each line contains the following whitespace separated field, in order:

• Application protocol (as reported by libprotoident)
• IP address of the first endpoint
• IP address of the second endpoint
• Port used by the first endpoint
• Port used by the second endpoint
• Transport protocol (6 = TCP, 17 = UDP)
• Unix timestamp when the flow began
• Unix timestamp when the flow ended
• Total bytes sent from first endpoint to second endpoint
• Total bytes sent from second endpoint to first endpoint
• First four bytes of payload sent from first endpoint (in hex)
• First four bytes of payload sent from first endpoint (ASCII)
• Size of first payload-bearing packet sent from first endpoint
• First four bytes of payload sent from second endpoint (in hex)
• First four bytes of payload sent from second endpoint (ASCII)
• Size of first payload-bearing packet sent from second endpoint

🔗 LINKS 🔗

More details about libprotoident, the protocols it supports, and how it works can be found at https://github.com/wanduow/libprotoident/wiki. Go read, iykyk. 📚✨

👀 SEE ALSO 👀

lpi_arff(1), lpi_find_unknown(1) — yes bestie, check those out too. 💖

👑 AUTHORS 👑

Shane Alcock <shane.alcock@waikato.ac.nz> — slay. 🙌

mwah 💋 this page is from libprotoident, dated April 2019 — and that's the LPI_PROTOIDENT(1) manual page, bestie. 🎀✨