Hybrid Pcap Analyser using T-Shark a tool that Makes use of Open Source Analyser that Can Meet Industrial Standards.

Abstract

In general, Pcap file contains the network packets that are captured by the packet capture tool such as Wireshark, tcpdump, TShark etc. PCAP files can be obtains by intercepting network packets that are transmitted in the network. The use of PCAP is that the network investigator can be able to transfer the entire network data in a single file and it can also be used for Future analysis. This paper is about a method that can parse PCAP files in a new approach by reducing the time taken to investigate the PCAP file in multiple ways and this is done by parsing pcap which makes use of existing open source packet analyser. In order to achieve this method, I have developed a tool and the main feature of this tool is that it can be installed in one system and can be used in many systems within an organisation.