Usage Tips

Some general tips for use the traffic-taffy tools are below. These tips are particularly helpful to the taffy-compare and taffy-graph tools, but most of the tools support these dissection and output limiting flags.

Use caching

Use the -C switch to write cache files next to the processed PCAP files when possible. This takes a bit of disk space but greatly feeds up future runs.

Start with fast comparisons of limited packet numbers

Especially when you need rapid answers for responding to incoming attacks, start with a fixed number of packets (e.g. 10,000) and use a faster dissection level (3).

Argument	Description
-d 3	set the dissection level to 3
-n 10000	parse at most 10k packets

(Eventually you’ll always want level 10, but it’s more CPU and memory intensive)

Start comparisons with large filtering thresholds

For filtering the output to show only the major differences, limit what is reported to a high number of minimum enumerations, and/or only with at least a decent percentage change. Also, limit each section results to just the top 10 or so differences. You might want to sort by a particular column (e.g. right) too if sorting by the delta percentage isn’t showing interesting data.

Note: these clauses are logically ANDed together.

Argument	Description
-c 1000	Show only differences with at least 1000 counts
-t 10	Show only differences with at least a 10% change:
-R 10	Show only the top 10 differences:
-s right	Optionally sort by the right column instead of the delta %

Filter the outputs to the likely candidate packets

The tools support filtering the output both by packet field name and by value, which can be highly helpful for generating output from both taffy-compare and taffy-graph. For example, if you know you want to study DNS packet fields in particular and really just for names example.com you can use -m DNS -M example.com to limit the results.

Argument	Description
-m DNS	limit the output to just field names with “DNS” in the name
-M example.com	limit the output to just field values with “exmaple.com” in them

TODO: currently these matches are simple, fast in-the-string matches only. Regular expressions are needed in the future.