Determining Windows application ports

#!/bin/sh

# The script requires the IP address of the machine that ran
# the packet capture and the WINDUMP capture file in binary
# format as arguments
if [ "$#" -lt 1 ] ; then
   echo "Usage: $0 WINDUMP_capture_file(s)"
   exit 1
fi

# Declare variables

# IP address of machine that ran packet capture
IP_ADDRESS=192.168.1.100

# Subnet directed broadcast address of machine that ran packet capture
# Ex. 192.168.1.51/25 (255.255.255.128 subnet mask) = 192.168.1.127
# Ex. 192.168.1.152/25 (255.255.255.128 subnet mask) = 192.168.1.255
DB_ADDRESS=192.168.1.127

# Path to WinDump executable
WINDUMP=/cygdrive/c/windump/WinDump.exe

# If $USE_NSLOOKUP is "true", use "nslookup" for DNS resolution
# Otherwise, set $USE_NSLOOKUP to "false" to search for hostnames in $DNS_DATA
USE_NSLOOKUP=true
DNS_DATA=/cygdrive/c/windump/DNS_data

# Berkeley Packet Format (BPF) filters

# Outbound traffic

# Interested in traffic from the host's IP address (src host $1)
# Interested in IP traffic (ip)
# Not interested in broadcast traffic (dst host 255.255.255.255)
# Not interested in directed broadcast traffic (dst host $DB_ADDRESS)
# Not interested in multicast traffic (dst net 224.0.0.0/24)

# Inbound traffic

# Interested in TCP SYN packets destined to $IP_ADDRESS

for FILE in $@
do
   # Outbound traffic
   $WINDUMP -n -r $FILE "\
   src host $IP_ADDRESS and \
   ip and \
   not (dst host 255.255.255.255) and \
   not (dst host $DB_ADDRESS) and \
   not (dst net 224.0.0/24)" 2>/dev/null \
   | awk '{if ($6 ~ /UDP,/) PROTO = "udp"; else PROTO = "tcp"} {print $5"\t"PROTO"\t"FILE}' FILE=$FILE | sort | uniq -c | sort -n >> $$_outbound.tmp

   # Inbound traffic
   $WINDUMP -n -r $FILE 2>/dev/null \
   | awk '$6 == "S" && $8 == "win" && $5 ~ IP_ADDRESS {print $3"\ttcp\t"FILE"\t"$5}' FILE=$FILE IP_ADDRESS=$IP_ADDRESS | sort | uniq -c | sort -n >> $$_inbound.tmp
done

# Generate report sorted by occurrence(s) of network traffic
printf "Outbound traffic\n\n"
printf "%-4s %-10s %-15s %-22s %s\n" "Mtch" "App" "Destination" "Prot/Port/Srv" "Hostname"
printf "%-4s %-10s %-15s %-22s %s\n" "----" "----------" "---------------" "----------------------" "--------"

while read LINE
do
   set $LINE
   COUNT=$1
   DST_IP=`echo $2 | cut -d. -f1-4`
   DST_PORT=`echo $2 | cut -d. -f5 | tr -d ':'`
   PROTO=$3
   FILE=$4
   SERVICE=`grep -w "${DST_PORT}/${PROTO}" /etc/services | awk '{print $1}'`
   # If $USE_NSLOOKUP is true, use "nslookup" for DNS resolution
   # Otherwise, search for hostnames in $DNS_DATA
   if [ "$USE_NSLOOKUP" = true ] ; then
      HOSTNAME=`nslookup $DST_IP 2>/dev/null | awk 'NR == 4 && $1 ~ /^Address:/ {print $2}'`
   else   
      HOSTNAME=`grep $DST_IP $DNS_DATA | awk '{print $1}' | head -n1`
   fi
   if [ -n "$SERVICE" ] ; then
      printf "%-4s %-10s %-15s %-22s %s\n" $COUNT $FILE $DST_IP "${PROTO}/${DST_PORT} (${SERVICE})" $HOSTNAME
   else
      printf "%-4s %-10s %-15s %-22s %s\n" $COUNT $FILE $DST_IP "${PROTO}/${DST_PORT}" $HOSTNAME
   fi
done < $$_outbound.tmp

printf "\nInbound traffic\n\n"
printf "%-4s %-10s %-15s %-22s %s\n" "Sess" "App" "Source" "Prot/Port/Srv" "Hostname"
printf "%-4s %-10s %-15s %-22s %s\n" "----" "----------" "---------------" "----------------------" "--------"

while read LINE
do
   set $LINE
   COUNT=$1
   SRC_IP=`echo $2 | cut -d. -f1-4`
   DST_PORT=`echo $5 | cut -d. -f5 | tr -d ':'`
   PROTO=$3
   FILE=$4
   SERVICE=`grep -w "${DST_PORT}/${PROTO}" /etc/services | awk '{print $1}'`
   # If $USE_NSLOOKUP is true, use "nslookup" for DNS resolution
   # Otherwise, search for hostnames in $DNS_DATA
   if [ "$USE_NSLOOKUP" = true ] ; then
      HOSTNAME=`nslookup $DST_IP 2>/dev/null | awk 'NR == 4 && $1 ~ /^Address:/ {print $2}'`
   else   
      HOSTNAME=`grep $DST_IP $DNS_DATA | awk '{print $1}' | head -n1`
   fi
   if [ -n "$SERVICE" ] ; then
      printf "%-4s %-10s %-15s %-22s %s\n" $COUNT $FILE $SRC_IP "${PROTO}/${DST_PORT} (${SERVICE})" $HOSTNAME
   else
      printf "%-4s %-10s %-15s %-22s %s\n" $COUNT $FILE $SRC_IP "${PROTO}/${DST_PORT}" $HOSTNAME
   fi
done < $$_inbound.tmp
 
# Remote temporary file
rm $$_outbound.tmp
rm $$_inbound.tmp

Last modified: 10/11/2004