Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be very helpful. Thanks.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

There is no simple way to find the application from a trace. Reading the ports may give an idea (25 = SMTP, 80 = HTTP, etc) but it is far from enough since some applications use a lot of varying ports (BitTorrent) and some applications run (cuckoo-style) on another port to pass through firewalls (for instance, it is quite common to have SSH servers on port 443, to be sure to reach them even from airport and hotel hotspots).

DPI (Deep Packet Inspection) may help but many applications are encrypted or use other DPI evasion techniques, since DPI is often used for nefarious reasons.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.