PacketDB

The initial goal of the PacketDB project is to create a set of workflows that treat tcpdumps/packet captures as just another sort of data to be loaded into relational structures and manipulated using the well-established methods of relational databases.

The real fun begins after the scripts run and you get to play with that delicious data!

After that ETL phase stabilizes (hopefully), the project would ideally expand into providing tools for discovery and reporting on that data (i.e. data mining and data warehousing). The tables existing for this first phase of the project might be thought of as staging tables for a load up to a datamart or data warehouse.
Required software for this current version:
  • mysql 5.0 (developed with 5.0.22)
  • python (tested with 2.3.5 and 2.5)
  • MySQL-python (developed with 1.2.1.p2)
  • Impacket from Core Security Technologies (developed with 0.9.6.0)
  • pcapy from Core Security Technologies (developed with 0.10.4)
  • A note on the required software -- this is the language and database that was most convenient for this at the time. The project itself is generic enough to have version in a variety of languages against any relational database.
    So, have a look at the Sourceforge project page, code in cvs , or grab the alpha tarball.
    SourceForge.net Logo