Original computing articles by a systems administrator

Creating a Histogram of TCP Window Sizes from a Packet Capture using Python

Although wireshark is a very useful tool there are some limitations that bother me:

  • Wireshark Out of Memory errors can be frustrating
  • Although advanced IO graphing provides a lot power it is still limited
  • I have found that scapy and pylab can fill some of the gaps. Here is an example using the python interactive interpreter:

    from scapy.all import IP,TCP,rdpcap
    from pylab import *
    #Import the Capture File
    a = rdpcap('smaller-out_00000_20110214101853')
    #Filter the Capture File
    b = [ pkt for pkt in a if IP in pkt and 
          (pkt[IP].src == '' or pkt[IP].dst == '') ]
    #Create an array of TCP Window sizes from the capture
    wins = [ int(win[TCP].window) for win in b if TCP in win ]
    #Create the Histogram
    hist(wins, bins=100)
    #Display it
    xlabel('TCP Window Size')

    TCP Window Size Histrogram

    Leave a Reply