Xplico Network Forensic Analysis Tool Demo

A lot of times when we audit network traffic, we are left with huge dumps of PCAP trace files and we just wish we could do something meaningful with it. Xplico, a recently released tool by Gianluca Costa & Andrea De Franceschi addresses this problem head-on. Xplico is a Network Forensic Analysis Tool (NFAT) released under GNU GPL. The goal of Xplico is to extract from an Internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on. Xplico isn’t a network protocol analyzer.

In this two part video demo of Xplico created by Bricowifi, we will see how to get started with the tool and analyze traffic live or from an offline pcap file. Bricowifi demonstrates how images, videos, ftp passwords and a host of other things can be retreived from pcap files using Xplico. I highly recommend watching the 2 videos to sample the powerful capabilities with which Xplico ships. Also, Bricowifi has created a detailed tutorial on Xplico usage in French here.

You can download Xplico from their site here. I would highly recommend this tool to anyone who is serious about analyzing flows and data in pcap files. Enjoy!

We hate these ADs as much as you do! Help us stay FREE and CLEAN by making a Generous Donation!

Vivek Ramachandran is a security evangelist and has been working in computer security related fields for the past 7 years. In 2007, Vivek spoke at world renowned conferences Defcon (WEP Cloaking Exposed) and Toorcon (The Caffe Latte Attack). The discovery of the Caffe Latte Attack was covered by CBS5 news, BBC online, Network World etc news agencies.In 2006, Vivek was announced as one of winners of the Microsoft Security Shootout contest held in India among 65,000 participants. He has also been a recipient of a Team Achievement at Cisco Systems for his work on 802.1x and Port Security modules on the Catalyst 6500 switches. Currently he spends all of his time maintaining Security- Freak.Net , SecurityTube.Net and is the co-founder of Axonize. Vivek, is a Bachelor in Electronics and Communications Engineering from the prestigious Indian Institute of Technology, Guwahati.You can contact him at vivek[at]securitytube.net