arjenz / packetq Goto Github PK

PacketQ is a command line tool to run sql queries directly on pcap files.

However, PacketQ also contain a very simplistic webserver in order 
to inspect pcap files remotely and a simple prototype AJAX-based GUI.

Sample command lines:

	packetq -s "select * from dns limit 10" sample.pcap
	    
	    Retrives the 10 first packets containing dns information from the file "sample.pcap"

	packetq -d -p8080 -w html/ -r pcap/

	    Starts a webserver on port 8080 (-p8080) as a daemon (-d) servering files from the 
	    directory html/ (-w html/) and pcapfiles from the directory pcap/ (-r pcap/).

To install: download and unpack the source from: 
https://github.com/dotse/PacketQ/tarball/master, 
then type "./configure; make; make install"

Pre-compiled binaries for Mac OS can be found at: 
https://github.com/dotse/PacketQ/raw/master/bin/macos/packetq.zip

More information is provided in our wiki on https://github.com/dotse/packetq/wiki
We also have a public mailing-list at http://lists.iis.se/mailman/listinfo/packetq

A short demo-video of PacketQs capabilities is available on http://www.youtube.com/watch?v=70wJmWZE9tY

License and terms for use and redistribution is here https://github.com/dotse/PacketQ/blob/master/COPYING