Traffic-taffy: finding tasty bumps in your network’s traffic

The traffic-taffy project aims to help you compare PCAP files that contain both normal traffic loads and unusual spikes. Also see the GitHub repository and the Project Webpage (which contains two introduction videos).

Contents:

• Getting Started
  • Installation
  • Example usage
  • Input file types supported
  • Important command line options
  • Speed comparison for different levels
  • Typical workflow
  • Dealing with endless configuration options
• An Example Case Study
  • The Dataset
  • Producing Cache Files
  • Starting with a high-level analysis
• Usage Tips
  • Use caching
  • Start with fast comparisons of limited packet numbers
  • Start comparisons with large filtering thresholds
  • Filter the outputs to the likely candidate packets
• Command Line Options
  • Options affecting packet parsing and dissection
  • Options limiting the display output
  • taffy-compare output options
  • taffy-graph output options
  • Debugging options
• Traffic-Taffy Tools
  • taffy-dissect - dissect and count packet types within a pcap file
  • taffy-cache-info - display details of a taffy cache file
  • taffy-compare - compare reference and anomaly traffic
  • taffy-graph - graph packet components in pcap files
  • taffy-config - dump configuration structure to the console
  • taffy-explorer - UI for exploring and comparing pcap files
• Extra Processing Modules
  • ip2asn
  • psl
  • labels
  • blag
• Significant Version Changes

Acknowledgments

We greatly thank Comcast for this project was made possible through their Comcast Innovation Fund.

Indices and tables

• Index

• Module Index

• Search Page