Xplico - Revision history

Iserm at 07:42, 11 June 2012

2012-06-11T07:42:23Z

Iserm at 19:27, 24 November 2008

2008-11-24T19:27:49Z

.FUF at 15:51, 8 October 2008

2008-10-08T15:51:55Z

Iserm at 10:04, 24 May 2008

2008-05-24T10:04:03Z

Iserm at 14:58, 19 May 2008

2008-05-19T14:58:53Z

Iserm at 14:55, 19 May 2008

2008-05-19T14:55:13Z

Iserm at 14:52, 19 May 2008

2008-05-19T14:52:04Z

Iserm at 15:39, 3 March 2008

2008-03-03T15:39:53Z

Iserm: New page: {{Infobox_Software | name = Xplico | maintainer = Gianluca Costa & Andrea de Franceschi | os = {{Linux}} | genre = {{Analysis}} | license = {{GPL}} | website = [http://www....

2008-03-03T15:37:10Z

New page: {{Infobox_Software | name = Xplico | maintainer = Gianluca Costa & Andrea de Franceschi | os = {{Linux}} | genre = {{Analysis}} | license = {{GPL}} | website = [http://www....

New page

{{Infobox_Software |
name = Xplico |
maintainer = [[Gianluca Costa & Andrea de Franceschi]] |
os = {{Linux}} |
genre = {{Analysis}} |
license = {{GPL}} |
website = [http://www.xplico.org www.xplico.org] |
}}

The '''Xplcio''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is extract from a network capture (pcap file or real-time acquisition) all application data content. For example, Xplico from a pcap file is able to extract all emails carried by the POP and SMTP protocols and all content carried by HTTP protocols.

@@ Line 12: / Line 12: @@
              <ul>
                <li>Protocols supported: [http://www.xplico.org/status HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...];</li>
                <li>Port Independent Protocol Identification (PIPI) for each application protocol;</li>
                <li>Multithreading;</li>
@@ Line 21: / Line 22: @@
                <li>No size limit on data entry or the number of files entrance (the only limit is HD size).</li>
              </ul>

@@ Line 11: / Line 11: @@
 <h2>Features</h2>
              <ul>
-               <li>Protocols supported: [http://www.xplico.org/status.html HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...];</li>
+               <li>Protocols supported: [http://www.xplico.org/status HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...];</li>
                <li>Port Independent Protocol Identification (PIPI) for each application protocol;</li>
                <li>Multithreading;</li>

@@ Line 8: / Line 8: @@
 }}
-The '''Xplico''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is extract from a network capture (pcap file or real-time acquisition) all application data content. For example, Xplico from a pcap file is able to extract all emails carried by the POP and SMTP protocols and all content carried by HTTP protocols.
+The '''Xplico''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is to extract all application data content from a network capture (pcap file or real-time acquisition). For example, Xplico is able to extract all e-mails carried by the POP and SMTP protocols, and all content carried by HTTP protocol from a pcap file.
 <h2>Features</h2>
              <ul>
@@ Line 14: / Line 14: @@
                <li>Port Independent Protocol Identification (PIPI) for each application protocol;</li>
                <li>Multithreading;</li>
-               <li>Output data and information in SQLite database or Mysql database and/or files;</li>
+               <li>Output data and information in SQLite database or MySQL database and/or files;</li>
-               <li>At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;</li>
+               <li>At each data reassembled by Xplico is associated a [[XML]] file that uniquely identifies the flows and the pcap containing the data reassembled;</li>
                <li>Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer ---RAM, CPU, HD access time, ...--- );</li>
                <li>TCP reassembly with ACK verification for any packet or soft ACK verification;</li>
                <li>Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;</li>
-               <li>No size limit on data entry or the number of files entrance (the only limit is HD size);</li>
+               <li>No size limit on data entry or the number of files entrance (the only limit is HD size).</li>
              </ul>

@@ Line 11: / Line 11: @@
 <h2>Features</h2>
              <ul>
                <li>Port Independent Protocol Identification (PIPI) for each application protocol;</li>
                <li>Multithreading;</li>
@@ Line 19: / Line 20: @@
                <li>Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;</li>
                <li>No size limit on data entry or the number of files entrance (the only limit is HD size);</li>
              </ul>

@@ Line 19: / Line 19: @@
                <li>Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;</li>
                <li>No size limit on data entry or the number of files entrance (the only limit is HD size);</li>
-               <li>Protocols supported: [http://www.xplico.org/status.html HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...];</li>
+               <li>Protocols supported: [http://www.xplico.org/status.html HTTP, SIP, FTP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...];</li>
              </ul>

← Older revision		Revision as of 14:52, 19 May 2008
Line 9:		Line 9:

	The '''Xplico''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is extract from a network capture (pcap file or real-time acquisition) all application data content. For example, Xplico from a pcap file is able to extract all emails carried by the POP and SMTP protocols and all content carried by HTTP protocols.		The '''Xplico''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is extract from a network capture (pcap file or real-time acquisition) all application data content. For example, Xplico from a pcap file is able to extract all emails carried by the POP and SMTP protocols and all content carried by HTTP protocols.
		+	<h2>Features</h2>
		+	<ul>
		+	<li>Port Independent Protocol Identification (PIPI) for each application protocol;</li>
		+	<li>Multithreading;</li>
		+	<li>Output data and information in SQLite database or Mysql database and/or files;</li>
		+	<li>At each data reassembled by Xplico is associated a XML file that uniquely identifies the flows and the pcap containing the data reassembled;</li>
		+	<li>Realtime elaboration (depends on the number of flows, the types of protocols and by the performance of computer ---RAM, CPU, HD access time, ...--- );</li>
		+	<li>TCP reassembly with ACK verification for any packet or soft ACK verification;</li>
		+	<li>Reverse DNS lookup from DNS packages contained in the inputs files (pcap), not from external DNS server;</li>
		+	<li>No size limit on data entry or the number of files entrance (the only limit is HD size);</li>
		+	<li>Protocols suppored: [http://www.xplico.org/status.html HTTP, SIP, IMAP, POP, SMTP, TCP, UDP, IPv4, IPv6, ...];</li>
		+	</ul>

← Older revision		Revision as of 15:39, 3 March 2008
Line 8:		Line 8:
	}}		}}

−	The '''~~Xplcio~~''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is extract from a network capture (pcap file or real-time acquisition) all application data content. For example, Xplico from a pcap file is able to extract all emails carried by the POP and SMTP protocols and all content carried by HTTP protocols.	+	The '''Xplico''' is a Network Forensic Analysis Tool (NFAT). The main scope of Xplico is extract from a network capture (pcap file or real-time acquisition) all application data content. For example, Xplico from a pcap file is able to extract all emails carried by the POP and SMTP protocols and all content carried by HTTP protocols.