Hi I research DDoS attack solution. but, i can't find how to see the pair flow number in the wireshark. pair flow means below example host 1 --> src(1.1.1.1) dst(2.2.2.2) host 2 --> src(2.2.2.2) dst(1.1.1.1) host1 and host2 are pair pair flow number is very important element for DDoS detection. pleases help me. asked 05 Apr '15, 20:45  Soong |
One Answer:
There is no built-in function in Wireshark to do that. You can use tshark and some scripting to find the pair flows.
Then parse the output to find the pair flows that match your definition. BTW: I added the IP protocol (ip.proto) and the ports, because the following paper includes the identical protocol as part of the "pair-flow" definition. If you don't need them, remove the options or ignore them in your script. Regards answered 06 Apr '15, 03:16  Kurt Knochner ♦ edited 06 Apr '15, 03:18 |
