This chapter gives an overview over Netdude's view of a trace file and explains how to use the Netdude GUI.
tcpdump trace files often are huge; files that are Gigabytes in size are not uncommon. This makes it prohibitive to just blindly load a trace file into memory when the user opens a trace. Instead, Netdude always only keeps a small section of the trace in memory [1], allowing you to jump to arbitrary locations in the trace based on timestamps and percentage offsets (as explained later in more detail).
Since Netdude allows the user to add and delete packets, it is not enough to just memory-map the trace file. Rather, it keeps track of the manipulations the user performs and swaps out modified trace parts when the user jumps to a different part in the trace. When an operation is performed on all packets in the trace, a new copy of the trace is created in a configurable scratch space area, merging currently existing modified trace parts back into a new consolidated temporary trace. to the user.
Here's a screenshot of Netdude's main window with two trace files open.
Netdude's main window.
Most things should be obvious -- the GUI is a regular multi-document interface. The menus allow quick access to frequently-used features. Trace files are displayed in a notebook widget, each trace being displayed in its own tab, labeled with the trace's file name. The close button on the tab is green while the trace is unmodified and turns red when packets get modified. The other button sets the packet iteration mode for a trace. This mode defines active packet set, that is, the set of packets to which packet modifications are applied. There are three such modes:
Selected packets: changes are applied to all currently selected packets.
Loaded packets: changes are applied to all packets currently in memory.
All packets: changes are applied to all packets, including those not currently in memory. When using this mode, Netdude tries to queue changes so that batches of changes can be applied in a single pass over the trace, instead of performing repeated passes over the (potentially huge) file.
In each trace tab, the upper part of the window is occupied by the tcpdump output of the current trace. Left-clicking in the list selects packets, right-clicking pops up the Edit menu as a shortcut. The protocol headers contained in a packet are listed as tabs in the lower part, in nesting order from left to right. You can look at and edit the protocols by clicking on the corresponding tab.
Packets can be filtered, either manually by selecting 'Edit→Filter' or 'Edit→Unfilter', or by applying a previously created filter to a set of packets. Filtered packets are still displayed, but in a brighter color. When a trace file is saved to disk, all filtered packets are dropped. For more details on filtering packets, see the Section on Filtering.
By clicking on the buttons in the lower part of the window you can edit header field values. Changes to fields are applied to packets depending on the packet iteration mode selected for the current trace as explained above.
Each field in a protocol header has a state, and protocol plugins can change these states to indicate certain circumstances. In the protocol plugins shipped with Netdude, incorrect checksums will appear red, while in situations where the correctness of a checksum cannot be determined (e.g., because not all data covered by the checksum is present), it will appear yellow.
To get a quick overview of a trace, load and select it, then click on 'File→Info'. You will get a dialog with content similar to the following:
Netdude's trace information dialog.
Netdude allows you to jump to other packets in a trace file in a number of different ways. Within the currently loaded part of the trace, you can jump to the
Next/Previous Selected Packet by using either 'Go→Next selected' or 'Go→Previous selected'.
Next/Previous Packet with same Protocol: depending on the currently selected protocol type and nesting level, Netdude will attempt to jump to the next/previous packet that contains the same protocol at the same nesting level, skipping filtered packets. Use 'Go→Next with same protocol' or 'Go→Previous with same protocol' or the corresponding shortcuts, respectively. This is most useful for browsing packets in the current trace part, as it makes it easier to follow traffic flows.
Next/Previous unfiltered Packet: using 'Go→Next unfiltered' and 'Go→Previous unfiltered', you can jump to the next/previous packet that is not currently filtered out.
Netdude's trace navigation dialog.
The dialog allows you to jump to other parts in the trace in three ways:
In time: in the upper part of the dialog, you see the start and end timestamps of the trace. After selecting the notebook tab labeled 'Time', you can enter any timestamp within this range directly, or by dragging the scrollbar to the timestamp you desire. After that, click on 'Jump as specified' to perform the actual jump.
In space: after clicking on the notebook tab labeled 'Space', you can drag the scrollbar to a relative offset in the trace (e.g., 75% would mean a jump to the point in the trace located at three quarters of the trace file's size). Again, clicking on 'Jump as specified' performs the actual jump.
Blockwise: To simply browse in the trace, just click on 'Previous block' or 'Next block'. The jumps are performed directly, so there is no need to click 'Jump as specified' as in the other cases.
The ability to filter packets is essential for performing reasonable packet modifications. Netdude has a generic filter API that allows plugins to register their own filters, while still allowing the user to easily manipulate these filters through the GUI.
There are two things to keep in mind about filtered packets:
No matter what packet iteration mode is in use, packet modifications are never applied to filtered packets.
When a trace file containing filtered packets is saved, all filtered packets are dropped.
Netdude's filter creation dialog (back), ready to create a new BPF filter (front).
An instance of the filter application dialog.
After applying the FTP data filter.
Whenever Netdude encounters data that is not specifically interpreted by some protocol plugin, the data is displayed using Netdude's payload editor, in a separate tab. Netdude tries to give the tab a meaningful label by looking at TCP or UDP port numbers when available. If this fails, the tab reads "(rest)".
This editor supports two modes of operation -- hex and ASCII. In hex mode, it works like usual hex editors. An image of an editing session is shown below:
Editing raw data using the hex editor.
By clicking into the editor field, the cursor is placed either over a hex digit or the corresponding ASCII display on the right. The actual cursor is blue, the corresponding indicator in the other display part in a bright gray [2].
But Netdude's payload editor is better than that. For normal text, editing using the hex editor is cumbersome. You can use ASCII mode in those situations -- here the editor behaves more like a normal text editor. You can literally type up packet content. However, be aware that when typing in more text than existed previously, some text is dropped at the end of the packet, as the size of the packet is not actually increased.
Editing raw data using the ASCII editor.
There's one point that needs to be addressed when editing arbitrary binary data using the ASCII characters: unprintable characters and the null character, which normally delimits character strings. These characters are displayed as follows:
The null character is displayed using ASCII code 0xf8, which is a circle with a diagonal line crossing it diagonally, thus looking a bit like a "0".
Other nonprintable characters (those smaller than 0x20 and in the 0x7f - 0xa0 range, except newlines) are printed using a centered little dot.
When editing data in ASCII mode, the size of the data chunk you are modifying is not increased. This means that for every excess character you are adding, there is a character falling off the end and lost. You can see the affected characters displayed in a lighter hue, see the above screenshot for an example.
![]() | Modifications made to packets using the payload editor are always exclusively applied to the current packet, regardless of the trace's current packet iteration mode. |
---|---|
Netdude provides a single clipboard area for temporary storing packets and moving them around between traces. Just cut or copy packets into the clipboard using the 'Edit→Copy', 'Edit→Cut' or the same entries in the context menu obtainable by using right-click in the packet list. The clipboard also serves an important other purpose: when you are placing packets in the clipboard, their tcpdump output is placed in the X cut buffer. Afterwards, pasting in other applications like editors or email composers will give you