Tool Documentation:

xplico Usage Examples

Use the rltm module (-m rltm) and analyze traffic on interface eth0 (-i eth0):

[email protected]:~# xplico -m rltm -i eth0
xplico v1.0.1
Internet Traffic Decoder (NFAT).
See http://www.xplico.org for more information.

Copyright 2007-2012 Gianluca Costa & Andrea de Franceschi and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.
Configuration file (/opt/xplico/cfg/xplico_cli.cfg) found!
GeoLiteCity.dat found!
pcapf: running: 0/0, subflow:0/0, tot pkt:1
pol: running: 0/0, subflow:0/0, tot pkt:0
eth: running: 0/0, subflow:0/0, tot pkt:1
pppoe: running: 0/0, subflow:0/0, tot pkt:0
ppp: running: 0/0, subflow:0/0, tot pkt:0
ip: running: 0/0, subflow:0/0, tot pkt:0


Packages and Binaries:

xplico

The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP, and SMTP protocols), all HTTP contents, each VoIP call (SIP, MGCP, H323), FTP, TFTP, and so on. Xplico is not a network protocol analyzer.

Installed size: 10.00 MB
How to install: sudo apt install xplico

Dependencies:
  • apache2
  • binfmt-support
  • init-system-helpers
  • lame
  • libapache2-mod-php
  • libc6
  • libjson-c5
  • libmariadb3
  • libmaxminddb0
  • libndpi4.2
  • libpcap0.8
  • libpq5
  • libsqlite3-0
  • libssl3
  • openssl
  • php-cli
  • php-common
  • php-json
  • php-sqlite3
  • python3
  • python3-httplib2
  • python3-psycopg2
  • recode
  • sox
  • sqlite3
  • tshark
  • zlib1g
mfbc
[email protected]:~# mfbc -h
mfbc v1.2.2
Internet Traffic Decoder (NFAT).
See http://www.xplico.org for more information.

Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.

usage: mfbc [-h] [-s] [-l] [-i] [-c <config_file>] -p <port>
	-c config file
	-s silent
	-p connection port
	-i info (PEI generated by this manipulator)
	-l print all log in the screen
	-h this help
	NOTE: parameters MUST respect this order!


mfile
[email protected]:~# mfile -h
mfile v1.2.2
Internet Traffic Decoder (NFAT).
See http://www.xplico.org for more information.

Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.

usage: mfile [-h] [-s] [-l] [-i] [-c <config_file>] -p <port>
	-c config file
	-s silent
	-p connection port
	-i info (PEI generated by this manipulator)
	-l print all log in the screen
	-h this help
	NOTE: parameters MUST respect this order!


mpaltalk
[email protected]:~# mpaltalk -h
mpaltalk v1.2.2
Internet Traffic Decoder (NFAT).
See http://www.xplico.org for more information.

Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.

usage: mpaltalk [-h] [-s] [-l] [-i] [-c <config_file>] -p <port>
	-c config file
	-s silent
	-p connection port
	-i info (PEI generated by this manipulator)
	-l print all log in the screen
	-h this help
	NOTE: parameters MUST respect this order!


mwmail
[email protected]:~# mwmail -h
mwmail v1.2.2
Internet Traffic Decoder (NFAT).
See http://www.xplico.org for more information.

Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.

usage: mwmail [-h] [-s] [-l] [-i] [-c <config_file>] -p <port>
	-c config file
	-s silent
	-p connection port
	-i info (PEI generated by this manipulator)
	-l print all log in the screen
	-h this help
	NOTE: parameters MUST respect this order!


trigcap
[email protected]:~# trigcap -h

usage: trigcap [-v] -f <input_file> -t <pkt num> -b <pkt numbers before> -a <pkt numbers after> -o <output_file> [-h]
	-v version
	-f input pcap file
	-t trigger packet number
	-b packet numbers before trigger packet
	-a packet numbers after trigger packet
	-o output pcap file
	-h this help


xplico
[email protected]:~# xplico -h
xplico v1.2.2
Internet Traffic Decoder (NFAT).
See http://www.xplico.org for more information.

Copyright 2007-2019 Gianluca Costa & Andrea de Franceschi and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

This product includes GeoLite data created by MaxMind, available from http://www.maxmind.com/.

usage: xplico [-v] [-c <config_file>] [-h] [-s] [-g] [-l] [-i <prot>] -m <capute_module>
	-v version
	-c config file
	-h this help
	-i info of protocol 'prot' 
	-g display graph-tree of protocols
	-l print all log in the screen
	-s print every second the deconding status
	-m capture type module
	NOTE: parameters MUST respect this order!


xplico-webui
[email protected]:~# xplico-webui --help
[i] Something is already using port: 9876/tcp
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
apache2 1282381     root    6u  IPv6 867317      0t0  TCP *:9876 (LISTEN)
apache2 1282420 www-data    6u  IPv6 867317      0t0  TCP *:9876 (LISTEN)
apache2 1282422 www-data    6u  IPv6 867317      0t0  TCP *:9876 (LISTEN)
apache2 1282424 www-data    6u  IPv6 867317      0t0  TCP *:9876 (LISTEN)
apache2 1282425 www-data    6u  IPv6 867317      0t0  TCP *:9876 (LISTEN)
apache2 1282427 www-data    6u  IPv6 867317      0t0  TCP *:9876 (LISTEN)

UID          PID    PPID  C STIME TTY      STAT   TIME CMD
root     1282381       1  0 15:52 ?        Ss     0:00 /usr/sbin/apache2 -k start
www-data 1282420 1282381  0 15:52 ?        S      0:00 /usr/sbin/apache2 -k start
www-data 1282422 1282381  0 15:52 ?        S      0:00 /usr/sbin/apache2 -k start
www-data 1282424 1282381  0 15:52 ?        S      0:00 /usr/sbin/apache2 -k start
www-data 1282425 1282381  0 15:52 ?        S      0:00 /usr/sbin/apache2 -k start
www-data 1282427 1282381  0 15:52 ?        S      0:00 /usr/sbin/apache2 -k start

[*] Please wait for the Xplico service to start.
[*]
[*] You might need to refresh your browser once it opens.
[*]
[*]  Web UI: http://127.0.0.1:9876


xplico-webui-stop
[email protected]:~# xplico-webui-stop -h
* apache2.service - The Apache HTTP Server
     Loaded: loaded (/lib/systemd/system/apache2.service; disabled; preset: disabled)
     Active: inactive (dead)
       Docs: https://httpd.apache.org/docs/2.4/

Nov 27 15:52:58 kali systemd[1]: Starting The Apache HTTP Server...
Nov 27 15:52:58 kali apachectl[1282344]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Nov 27 15:52:58 kali systemd[1]: Started The Apache HTTP Server.
Nov 27 15:53:08 kali systemd[1]: Stopping The Apache HTTP Server...
Nov 27 15:53:08 kali apachectl[1297234]: AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Nov 27 15:53:08 kali systemd[1]: apache2.service: Deactivated successfully.
Nov 27 15:53:08 kali systemd[1]: Stopped The Apache HTTP Server.

* xplico.service - Xplico
     Loaded: loaded (/lib/systemd/system/xplico.service; disabled; preset: disabled)
     Active: inactive (dead)
       Docs: https://www.xplico.org/docs

Nov 27 15:52:58 kali systemd[1]: Starting Xplico...
Nov 27 15:52:58 kali systemd[1]: xplico.service: Can't open PID file /run/dema.pid (yet?) after start: Operation not permitted
Nov 27 15:52:58 kali systemd[1]: Started Xplico.
Nov 27 15:53:08 kali systemd[1]: Stopping Xplico...
Nov 27 15:53:08 kali systemd[1]: xplico.service: Deactivated successfully.
Nov 27 15:53:08 kali systemd[1]: Stopped Xplico.

Updated on: 2022-Nov-28