kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/net/tcpflow/Makefile

28 lines
766 B
Makefile
Raw Normal View History

Revbump after boost update
2018-01-01 22:18:06 +01:00
# $NetBSD: Makefile,v 1.14 2018/01/01 21:18:49 adam Exp $
Initial import of tcpflow-0.20, provided by Adrian Portelli via pkgsrc-wip. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. However, it currently does not understand IP fragments; flows containing IP fragments will not be recorded properly. tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like 'tcpdump' support.
2003-04-10 19:08:13 +02:00
#
Update net/tcpflow to 1.4.5. This package was last updated in 2004, since then it has changed maintainers and looks quite different. An incomplete changelog is as follows: Version 1.3.1 NOV ?? Complete rewrite of the TCP state machine, now handles flows larger than 4GiB. Version 1.3.0 SEP 30 2012 Release for end of FY2012, includes bug fixes, better support for autoconf, DFXML standardizations, and the ability to compile under mingw for Windows (that was a LOT of work). Version 1.2.7 May 24 2012 (GIT) Version 1.2.7 offers two significant features over previous versions relating to the processing of the -r and the new -R options. -r file1.pcap - This option specifies a pcap file to be read. New with version 1.2.7, the -r flag may be repeated any number of times. -R file0.pcap - This option, new with version 1.2.7, allows a file to be specified that was captured in time *before* the file specified with -r. This option allows TCP sessions that started in file0.pcap and which continued into file1.pcap to be properly started. This option is useful when some external process makes packet capture files at regular intervals and then the files are reassembled later. Typically these files result from tcpdump run with the -w or -C options. Version 1.2 March 15 2012 (SVN ) Version 1.2 is the first to include post-processing of TCP connections integrated directly into the tcpflow program itself. post-processing is optional and is performed on a per-connection basis when the connection is closed. The following post-processing method methods are currently defined. -FM - Compute the MD5 hash value of every stream on close. Currently MD5 hashes are only computed for TCP streams that contain packets transmitted contigiously. -FM processing can happen even when output is suppressed. The MD5 is written into the DFXML file. -AH - Detect Email/HTTP responses and separate headers from body. This requires that the output files be captured. If the output file is 208.111.153.175.00080-192.168.001.064.37314, Then the post-processing will create the files: 208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY If the HTTPBODY was compressed with GZIP, you may get a third file as well: 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP Additional information about these streams, such as their MD5 hash value, is also written to the DFXML file Version 1.1.0 19 January 2012 (SVN 8118) Version 1.1 represents a significant rewrite of tcpflow. All users are encouraged to upgrade. Significant changes include: * Entire code base migrated to C++ ; code generally improved. tcpflow's original hash table has been replaced with a tr1::unordered_map which should offer significantly more scalability. * tcpflow now automatically expires out old connections. This finally end the program's memory-hogging problem. (You can disable this behavior with -P, which makes tcpflow run faster because it never cleans up after itself. That's fine if you are working with less than a million connections.) * Multiple connections with the same (source/destination) are now detected and stored in different files. This is significant, as the previous implementation would make a single file 1-2GB in length if you the same host/port pairs with two different flows. Additional files have the same filename and a "c0001", "c0002" appended. * Filenames may now be prefixed with either the ISO8601 time or a Unix timestamp indicating the time that the connection was first seen. * tcpflow will now save a DFXML file containing information for each flow that it reconstructs. * The following new options are now implemented: -o outdir --- now works (previously was not implemented) -X xmfile --- now reports execution results in a DFXML file. (Version 1.1 will include complete notion in the XML file of every TCP connection as a DFXML <fileobject> -Fc --- Every file has the 'cXXXX' postfix, rather than just the files with duplicate source/destination. -Ft --- Every file has the <time_t>T prefix. -FT --- Every file has an ISO8601 time prefix, e.g. 2012-01-01T09:45:15Z -mNNNN --- Specifies the minimum number of bytes that need to be skipped in a TCP connection before a new -Lname --- use the named semaphore 'name' to prevent multiple tcpflow processes printing to standard output from overprinting each other. -P --- do not prune the tcp connection table. Other improvements include: * Support for IPv6 * Support for VLANs * The default filter which was causing problems under MacOS has been removed. Version 1.0.4 November 24, 2011 * Default fitler changed to ""; previous default filter was causing problems on macs. Version 1.0.2 September 30, 2011 * IPv6 code added Version 1.0.0 January 2011 * Updated to support VLANs. VLAN packets are marked by hex 0x8100 following the destination and source mac addresses, followed by the 16-bit VLAN address, followed by 0x0800 marking the beginning of the traditional IP header. Version 0.30 October 2007 * Simson Garfinkel <simsong@acm.org> is now the maintainer of this package * Modified to set the time of each tcpflow with the time of the first packet. * Created a regression test, so "make check" and "make distcheck" now work. * Updated to modern autoconf tools.
2017-07-04 15:50:41 +02:00
DISTNAME= tcpflow-1.4.5
Revbump after boost update
2018-01-01 22:18:06 +01:00
PKGREVISION= 2
Initial import of tcpflow-0.20, provided by Adrian Portelli via pkgsrc-wip. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. However, it currently does not understand IP fragments; flows containing IP fragments will not be recorded properly. tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like 'tcpdump' support.
2003-04-10 19:08:13 +02:00
CATEGORIES= net security
Update net/tcpflow to 1.4.5. This package was last updated in 2004, since then it has changed maintainers and looks quite different. An incomplete changelog is as follows: Version 1.3.1 NOV ?? Complete rewrite of the TCP state machine, now handles flows larger than 4GiB. Version 1.3.0 SEP 30 2012 Release for end of FY2012, includes bug fixes, better support for autoconf, DFXML standardizations, and the ability to compile under mingw for Windows (that was a LOT of work). Version 1.2.7 May 24 2012 (GIT) Version 1.2.7 offers two significant features over previous versions relating to the processing of the -r and the new -R options. -r file1.pcap - This option specifies a pcap file to be read. New with version 1.2.7, the -r flag may be repeated any number of times. -R file0.pcap - This option, new with version 1.2.7, allows a file to be specified that was captured in time *before* the file specified with -r. This option allows TCP sessions that started in file0.pcap and which continued into file1.pcap to be properly started. This option is useful when some external process makes packet capture files at regular intervals and then the files are reassembled later. Typically these files result from tcpdump run with the -w or -C options. Version 1.2 March 15 2012 (SVN ) Version 1.2 is the first to include post-processing of TCP connections integrated directly into the tcpflow program itself. post-processing is optional and is performed on a per-connection basis when the connection is closed. The following post-processing method methods are currently defined. -FM - Compute the MD5 hash value of every stream on close. Currently MD5 hashes are only computed for TCP streams that contain packets transmitted contigiously. -FM processing can happen even when output is suppressed. The MD5 is written into the DFXML file. -AH - Detect Email/HTTP responses and separate headers from body. This requires that the output files be captured. If the output file is 208.111.153.175.00080-192.168.001.064.37314, Then the post-processing will create the files: 208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY If the HTTPBODY was compressed with GZIP, you may get a third file as well: 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP Additional information about these streams, such as their MD5 hash value, is also written to the DFXML file Version 1.1.0 19 January 2012 (SVN 8118) Version 1.1 represents a significant rewrite of tcpflow. All users are encouraged to upgrade. Significant changes include: * Entire code base migrated to C++ ; code generally improved. tcpflow's original hash table has been replaced with a tr1::unordered_map which should offer significantly more scalability. * tcpflow now automatically expires out old connections. This finally end the program's memory-hogging problem. (You can disable this behavior with -P, which makes tcpflow run faster because it never cleans up after itself. That's fine if you are working with less than a million connections.) * Multiple connections with the same (source/destination) are now detected and stored in different files. This is significant, as the previous implementation would make a single file 1-2GB in length if you the same host/port pairs with two different flows. Additional files have the same filename and a "c0001", "c0002" appended. * Filenames may now be prefixed with either the ISO8601 time or a Unix timestamp indicating the time that the connection was first seen. * tcpflow will now save a DFXML file containing information for each flow that it reconstructs. * The following new options are now implemented: -o outdir --- now works (previously was not implemented) -X xmfile --- now reports execution results in a DFXML file. (Version 1.1 will include complete notion in the XML file of every TCP connection as a DFXML <fileobject> -Fc --- Every file has the 'cXXXX' postfix, rather than just the files with duplicate source/destination. -Ft --- Every file has the <time_t>T prefix. -FT --- Every file has an ISO8601 time prefix, e.g. 2012-01-01T09:45:15Z -mNNNN --- Specifies the minimum number of bytes that need to be skipped in a TCP connection before a new -Lname --- use the named semaphore 'name' to prevent multiple tcpflow processes printing to standard output from overprinting each other. -P --- do not prune the tcp connection table. Other improvements include: * Support for IPv6 * Support for VLANs * The default filter which was causing problems under MacOS has been removed. Version 1.0.4 November 24, 2011 * Default fitler changed to ""; previous default filter was causing problems on macs. Version 1.0.2 September 30, 2011 * IPv6 code added Version 1.0.0 January 2011 * Updated to support VLANs. VLAN packets are marked by hex 0x8100 following the destination and source mac addresses, followed by the 16-bit VLAN address, followed by 0x0800 marking the beginning of the traditional IP header. Version 0.30 October 2007 * Simson Garfinkel <simsong@acm.org> is now the maintainer of this package * Modified to set the time of each tcpflow with the time of the first packet. * Created a regression test, so "make check" and "make distcheck" now work. * Updated to modern autoconf tools.
2017-07-04 15:50:41 +02:00
MASTER_SITES= http://downloads.digitalcorpora.org/downloads/tcpflow/
Initial import of tcpflow-0.20, provided by Adrian Portelli via pkgsrc-wip. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. However, it currently does not understand IP fragments; flows containing IP fragments will not be recorded properly. tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like 'tcpdump' support.
2003-04-10 19:08:13 +02:00
Give up MAINTAINER
2009-07-17 20:00:13 +02:00
MAINTAINER= pkgsrc-users@NetBSD.org
Update net/tcpflow to 1.4.5. This package was last updated in 2004, since then it has changed maintainers and looks quite different. An incomplete changelog is as follows: Version 1.3.1 NOV ?? Complete rewrite of the TCP state machine, now handles flows larger than 4GiB. Version 1.3.0 SEP 30 2012 Release for end of FY2012, includes bug fixes, better support for autoconf, DFXML standardizations, and the ability to compile under mingw for Windows (that was a LOT of work). Version 1.2.7 May 24 2012 (GIT) Version 1.2.7 offers two significant features over previous versions relating to the processing of the -r and the new -R options. -r file1.pcap - This option specifies a pcap file to be read. New with version 1.2.7, the -r flag may be repeated any number of times. -R file0.pcap - This option, new with version 1.2.7, allows a file to be specified that was captured in time *before* the file specified with -r. This option allows TCP sessions that started in file0.pcap and which continued into file1.pcap to be properly started. This option is useful when some external process makes packet capture files at regular intervals and then the files are reassembled later. Typically these files result from tcpdump run with the -w or -C options. Version 1.2 March 15 2012 (SVN ) Version 1.2 is the first to include post-processing of TCP connections integrated directly into the tcpflow program itself. post-processing is optional and is performed on a per-connection basis when the connection is closed. The following post-processing method methods are currently defined. -FM - Compute the MD5 hash value of every stream on close. Currently MD5 hashes are only computed for TCP streams that contain packets transmitted contigiously. -FM processing can happen even when output is suppressed. The MD5 is written into the DFXML file. -AH - Detect Email/HTTP responses and separate headers from body. This requires that the output files be captured. If the output file is 208.111.153.175.00080-192.168.001.064.37314, Then the post-processing will create the files: 208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY If the HTTPBODY was compressed with GZIP, you may get a third file as well: 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP Additional information about these streams, such as their MD5 hash value, is also written to the DFXML file Version 1.1.0 19 January 2012 (SVN 8118) Version 1.1 represents a significant rewrite of tcpflow. All users are encouraged to upgrade. Significant changes include: * Entire code base migrated to C++ ; code generally improved. tcpflow's original hash table has been replaced with a tr1::unordered_map which should offer significantly more scalability. * tcpflow now automatically expires out old connections. This finally end the program's memory-hogging problem. (You can disable this behavior with -P, which makes tcpflow run faster because it never cleans up after itself. That's fine if you are working with less than a million connections.) * Multiple connections with the same (source/destination) are now detected and stored in different files. This is significant, as the previous implementation would make a single file 1-2GB in length if you the same host/port pairs with two different flows. Additional files have the same filename and a "c0001", "c0002" appended. * Filenames may now be prefixed with either the ISO8601 time or a Unix timestamp indicating the time that the connection was first seen. * tcpflow will now save a DFXML file containing information for each flow that it reconstructs. * The following new options are now implemented: -o outdir --- now works (previously was not implemented) -X xmfile --- now reports execution results in a DFXML file. (Version 1.1 will include complete notion in the XML file of every TCP connection as a DFXML <fileobject> -Fc --- Every file has the 'cXXXX' postfix, rather than just the files with duplicate source/destination. -Ft --- Every file has the <time_t>T prefix. -FT --- Every file has an ISO8601 time prefix, e.g. 2012-01-01T09:45:15Z -mNNNN --- Specifies the minimum number of bytes that need to be skipped in a TCP connection before a new -Lname --- use the named semaphore 'name' to prevent multiple tcpflow processes printing to standard output from overprinting each other. -P --- do not prune the tcp connection table. Other improvements include: * Support for IPv6 * Support for VLANs * The default filter which was causing problems under MacOS has been removed. Version 1.0.4 November 24, 2011 * Default fitler changed to ""; previous default filter was causing problems on macs. Version 1.0.2 September 30, 2011 * IPv6 code added Version 1.0.0 January 2011 * Updated to support VLANs. VLAN packets are marked by hex 0x8100 following the destination and source mac addresses, followed by the 16-bit VLAN address, followed by 0x0800 marking the beginning of the traditional IP header. Version 0.30 October 2007 * Simson Garfinkel <simsong@acm.org> is now the maintainer of this package * Modified to set the time of each tcpflow with the time of the first packet. * Created a regression test, so "make check" and "make distcheck" now work. * Updated to modern autoconf tools.
2017-07-04 15:50:41 +02:00
HOMEPAGE= https://github.com/simsong/tcpflow
Initial import of tcpflow-0.20, provided by Adrian Portelli via pkgsrc-wip. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. However, it currently does not understand IP fragments; flows containing IP fragments will not be recorded properly. tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like 'tcpdump' support.
2003-04-10 19:08:13 +02:00
COMMENT= Captures data transmitted as part of TCP connections
Update net/tcpflow to 1.4.5. This package was last updated in 2004, since then it has changed maintainers and looks quite different. An incomplete changelog is as follows: Version 1.3.1 NOV ?? Complete rewrite of the TCP state machine, now handles flows larger than 4GiB. Version 1.3.0 SEP 30 2012 Release for end of FY2012, includes bug fixes, better support for autoconf, DFXML standardizations, and the ability to compile under mingw for Windows (that was a LOT of work). Version 1.2.7 May 24 2012 (GIT) Version 1.2.7 offers two significant features over previous versions relating to the processing of the -r and the new -R options. -r file1.pcap - This option specifies a pcap file to be read. New with version 1.2.7, the -r flag may be repeated any number of times. -R file0.pcap - This option, new with version 1.2.7, allows a file to be specified that was captured in time *before* the file specified with -r. This option allows TCP sessions that started in file0.pcap and which continued into file1.pcap to be properly started. This option is useful when some external process makes packet capture files at regular intervals and then the files are reassembled later. Typically these files result from tcpdump run with the -w or -C options. Version 1.2 March 15 2012 (SVN ) Version 1.2 is the first to include post-processing of TCP connections integrated directly into the tcpflow program itself. post-processing is optional and is performed on a per-connection basis when the connection is closed. The following post-processing method methods are currently defined. -FM - Compute the MD5 hash value of every stream on close. Currently MD5 hashes are only computed for TCP streams that contain packets transmitted contigiously. -FM processing can happen even when output is suppressed. The MD5 is written into the DFXML file. -AH - Detect Email/HTTP responses and separate headers from body. This requires that the output files be captured. If the output file is 208.111.153.175.00080-192.168.001.064.37314, Then the post-processing will create the files: 208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY If the HTTPBODY was compressed with GZIP, you may get a third file as well: 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP Additional information about these streams, such as their MD5 hash value, is also written to the DFXML file Version 1.1.0 19 January 2012 (SVN 8118) Version 1.1 represents a significant rewrite of tcpflow. All users are encouraged to upgrade. Significant changes include: * Entire code base migrated to C++ ; code generally improved. tcpflow's original hash table has been replaced with a tr1::unordered_map which should offer significantly more scalability. * tcpflow now automatically expires out old connections. This finally end the program's memory-hogging problem. (You can disable this behavior with -P, which makes tcpflow run faster because it never cleans up after itself. That's fine if you are working with less than a million connections.) * Multiple connections with the same (source/destination) are now detected and stored in different files. This is significant, as the previous implementation would make a single file 1-2GB in length if you the same host/port pairs with two different flows. Additional files have the same filename and a "c0001", "c0002" appended. * Filenames may now be prefixed with either the ISO8601 time or a Unix timestamp indicating the time that the connection was first seen. * tcpflow will now save a DFXML file containing information for each flow that it reconstructs. * The following new options are now implemented: -o outdir --- now works (previously was not implemented) -X xmfile --- now reports execution results in a DFXML file. (Version 1.1 will include complete notion in the XML file of every TCP connection as a DFXML <fileobject> -Fc --- Every file has the 'cXXXX' postfix, rather than just the files with duplicate source/destination. -Ft --- Every file has the <time_t>T prefix. -FT --- Every file has an ISO8601 time prefix, e.g. 2012-01-01T09:45:15Z -mNNNN --- Specifies the minimum number of bytes that need to be skipped in a TCP connection before a new -Lname --- use the named semaphore 'name' to prevent multiple tcpflow processes printing to standard output from overprinting each other. -P --- do not prune the tcp connection table. Other improvements include: * Support for IPv6 * Support for VLANs * The default filter which was causing problems under MacOS has been removed. Version 1.0.4 November 24, 2011 * Default fitler changed to ""; previous default filter was causing problems on macs. Version 1.0.2 September 30, 2011 * IPv6 code added Version 1.0.0 January 2011 * Updated to support VLANs. VLAN packets are marked by hex 0x8100 following the destination and source mac addresses, followed by the 16-bit VLAN address, followed by 0x0800 marking the beginning of the traditional IP header. Version 0.30 October 2007 * Simson Garfinkel <simsong@acm.org> is now the maintainer of this package * Modified to set the time of each tcpflow with the time of the first packet. * Created a regression test, so "make check" and "make distcheck" now work. * Updated to modern autoconf tools.
2017-07-04 15:50:41 +02:00
LICENSE= gnu-gpl-v3
USE_LANGUAGES= c c++
Initial import of tcpflow-0.20, provided by Adrian Portelli via pkgsrc-wip. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. However, it currently does not understand IP fragments; flows containing IP fragments will not be recorded properly. tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like 'tcpdump' support.
2003-04-10 19:08:13 +02:00
GNU_CONFIGURE= YES
Update net/tcpflow to 1.4.5. This package was last updated in 2004, since then it has changed maintainers and looks quite different. An incomplete changelog is as follows: Version 1.3.1 NOV ?? Complete rewrite of the TCP state machine, now handles flows larger than 4GiB. Version 1.3.0 SEP 30 2012 Release for end of FY2012, includes bug fixes, better support for autoconf, DFXML standardizations, and the ability to compile under mingw for Windows (that was a LOT of work). Version 1.2.7 May 24 2012 (GIT) Version 1.2.7 offers two significant features over previous versions relating to the processing of the -r and the new -R options. -r file1.pcap - This option specifies a pcap file to be read. New with version 1.2.7, the -r flag may be repeated any number of times. -R file0.pcap - This option, new with version 1.2.7, allows a file to be specified that was captured in time *before* the file specified with -r. This option allows TCP sessions that started in file0.pcap and which continued into file1.pcap to be properly started. This option is useful when some external process makes packet capture files at regular intervals and then the files are reassembled later. Typically these files result from tcpdump run with the -w or -C options. Version 1.2 March 15 2012 (SVN ) Version 1.2 is the first to include post-processing of TCP connections integrated directly into the tcpflow program itself. post-processing is optional and is performed on a per-connection basis when the connection is closed. The following post-processing method methods are currently defined. -FM - Compute the MD5 hash value of every stream on close. Currently MD5 hashes are only computed for TCP streams that contain packets transmitted contigiously. -FM processing can happen even when output is suppressed. The MD5 is written into the DFXML file. -AH - Detect Email/HTTP responses and separate headers from body. This requires that the output files be captured. If the output file is 208.111.153.175.00080-192.168.001.064.37314, Then the post-processing will create the files: 208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY If the HTTPBODY was compressed with GZIP, you may get a third file as well: 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP Additional information about these streams, such as their MD5 hash value, is also written to the DFXML file Version 1.1.0 19 January 2012 (SVN 8118) Version 1.1 represents a significant rewrite of tcpflow. All users are encouraged to upgrade. Significant changes include: * Entire code base migrated to C++ ; code generally improved. tcpflow's original hash table has been replaced with a tr1::unordered_map which should offer significantly more scalability. * tcpflow now automatically expires out old connections. This finally end the program's memory-hogging problem. (You can disable this behavior with -P, which makes tcpflow run faster because it never cleans up after itself. That's fine if you are working with less than a million connections.) * Multiple connections with the same (source/destination) are now detected and stored in different files. This is significant, as the previous implementation would make a single file 1-2GB in length if you the same host/port pairs with two different flows. Additional files have the same filename and a "c0001", "c0002" appended. * Filenames may now be prefixed with either the ISO8601 time or a Unix timestamp indicating the time that the connection was first seen. * tcpflow will now save a DFXML file containing information for each flow that it reconstructs. * The following new options are now implemented: -o outdir --- now works (previously was not implemented) -X xmfile --- now reports execution results in a DFXML file. (Version 1.1 will include complete notion in the XML file of every TCP connection as a DFXML <fileobject> -Fc --- Every file has the 'cXXXX' postfix, rather than just the files with duplicate source/destination. -Ft --- Every file has the <time_t>T prefix. -FT --- Every file has an ISO8601 time prefix, e.g. 2012-01-01T09:45:15Z -mNNNN --- Specifies the minimum number of bytes that need to be skipped in a TCP connection before a new -Lname --- use the named semaphore 'name' to prevent multiple tcpflow processes printing to standard output from overprinting each other. -P --- do not prune the tcp connection table. Other improvements include: * Support for IPv6 * Support for VLANs * The default filter which was causing problems under MacOS has been removed. Version 1.0.4 November 24, 2011 * Default fitler changed to ""; previous default filter was causing problems on macs. Version 1.0.2 September 30, 2011 * IPv6 code added Version 1.0.0 January 2011 * Updated to support VLANs. VLAN packets are marked by hex 0x8100 following the destination and source mac addresses, followed by the 16-bit VLAN address, followed by 0x0800 marking the beginning of the traditional IP header. Version 0.30 October 2007 * Simson Garfinkel <simsong@acm.org> is now the maintainer of this package * Modified to set the time of each tcpflow with the time of the first packet. * Created a regression test, so "make check" and "make distcheck" now work. * Updated to modern autoconf tools.
2017-07-04 15:50:41 +02:00
CPPFLAGS.SunOS+= -Du_int8_t=uint8_t -Du_int16_t=uint16_t -DMAP_FILE=0
CPPFLAGS.SunOS+= -Du_int32_t=uint32_t -Du_int64_t=uint64_t
.include "options.mk"
.include "../../devel/boost-libs/buildlink3.mk"
.include "../../devel/zlib/buildlink3.mk"
Convert to buildlink3.
2004-04-18 09:30:16 +02:00
.include "../../net/libpcap/buildlink3.mk"
Update net/tcpflow to 1.4.5. This package was last updated in 2004, since then it has changed maintainers and looks quite different. An incomplete changelog is as follows: Version 1.3.1 NOV ?? Complete rewrite of the TCP state machine, now handles flows larger than 4GiB. Version 1.3.0 SEP 30 2012 Release for end of FY2012, includes bug fixes, better support for autoconf, DFXML standardizations, and the ability to compile under mingw for Windows (that was a LOT of work). Version 1.2.7 May 24 2012 (GIT) Version 1.2.7 offers two significant features over previous versions relating to the processing of the -r and the new -R options. -r file1.pcap - This option specifies a pcap file to be read. New with version 1.2.7, the -r flag may be repeated any number of times. -R file0.pcap - This option, new with version 1.2.7, allows a file to be specified that was captured in time *before* the file specified with -r. This option allows TCP sessions that started in file0.pcap and which continued into file1.pcap to be properly started. This option is useful when some external process makes packet capture files at regular intervals and then the files are reassembled later. Typically these files result from tcpdump run with the -w or -C options. Version 1.2 March 15 2012 (SVN ) Version 1.2 is the first to include post-processing of TCP connections integrated directly into the tcpflow program itself. post-processing is optional and is performed on a per-connection basis when the connection is closed. The following post-processing method methods are currently defined. -FM - Compute the MD5 hash value of every stream on close. Currently MD5 hashes are only computed for TCP streams that contain packets transmitted contigiously. -FM processing can happen even when output is suppressed. The MD5 is written into the DFXML file. -AH - Detect Email/HTTP responses and separate headers from body. This requires that the output files be captured. If the output file is 208.111.153.175.00080-192.168.001.064.37314, Then the post-processing will create the files: 208.111.153.175.00080-192.168.001.064.37314-HTTP 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY If the HTTPBODY was compressed with GZIP, you may get a third file as well: 208.111.153.175.00080-192.168.001.064.37314-HTTPBODY-GZIP Additional information about these streams, such as their MD5 hash value, is also written to the DFXML file Version 1.1.0 19 January 2012 (SVN 8118) Version 1.1 represents a significant rewrite of tcpflow. All users are encouraged to upgrade. Significant changes include: * Entire code base migrated to C++ ; code generally improved. tcpflow's original hash table has been replaced with a tr1::unordered_map which should offer significantly more scalability. * tcpflow now automatically expires out old connections. This finally end the program's memory-hogging problem. (You can disable this behavior with -P, which makes tcpflow run faster because it never cleans up after itself. That's fine if you are working with less than a million connections.) * Multiple connections with the same (source/destination) are now detected and stored in different files. This is significant, as the previous implementation would make a single file 1-2GB in length if you the same host/port pairs with two different flows. Additional files have the same filename and a "c0001", "c0002" appended. * Filenames may now be prefixed with either the ISO8601 time or a Unix timestamp indicating the time that the connection was first seen. * tcpflow will now save a DFXML file containing information for each flow that it reconstructs. * The following new options are now implemented: -o outdir --- now works (previously was not implemented) -X xmfile --- now reports execution results in a DFXML file. (Version 1.1 will include complete notion in the XML file of every TCP connection as a DFXML <fileobject> -Fc --- Every file has the 'cXXXX' postfix, rather than just the files with duplicate source/destination. -Ft --- Every file has the <time_t>T prefix. -FT --- Every file has an ISO8601 time prefix, e.g. 2012-01-01T09:45:15Z -mNNNN --- Specifies the minimum number of bytes that need to be skipped in a TCP connection before a new -Lname --- use the named semaphore 'name' to prevent multiple tcpflow processes printing to standard output from overprinting each other. -P --- do not prune the tcp connection table. Other improvements include: * Support for IPv6 * Support for VLANs * The default filter which was causing problems under MacOS has been removed. Version 1.0.4 November 24, 2011 * Default fitler changed to ""; previous default filter was causing problems on macs. Version 1.0.2 September 30, 2011 * IPv6 code added Version 1.0.0 January 2011 * Updated to support VLANs. VLAN packets are marked by hex 0x8100 following the destination and source mac addresses, followed by the 16-bit VLAN address, followed by 0x0800 marking the beginning of the traditional IP header. Version 0.30 October 2007 * Simson Garfinkel <simsong@acm.org> is now the maintainer of this package * Modified to set the time of each tcpflow with the time of the first packet. * Created a regression test, so "make check" and "make distcheck" now work. * Updated to modern autoconf tools.
2017-07-04 15:50:41 +02:00
.include "../../security/openssl/buildlink3.mk"
Initial import of tcpflow-0.20, provided by Adrian Portelli via pkgsrc-wip. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like 'tcpdump' shows a summary of packets seen on the wire, but usually doesn't store the data that's actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery. However, it currently does not understand IP fragments; flows containing IP fragments will not be recorded properly. tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like 'tcpdump' support.
2003-04-10 19:08:13 +02:00
.include "../../mk/bsd.pkg.mk"
Reference in a new issue Copy permalink