Ever located an old capture file and you weren’t sure what was in it or needed to grab some quick statistics about another capture file? What about needed to run statistics on multiple capture files and present them via a database or a spreadsheet? Well if you have ever run into any of these scenarios then capinfos is worth a look. The capinfos command is available via the Backtrack CLI and provides statistic information about cap files. This is one of the gems located on Backtrack that nobody ever hears about.

Cap File Statistics Via capinfos On Backtrack Linux:

Located in the /usr/local/bin directory the capinfos command will provide statistics about capture files. The capinfos command outputs various statistics by default but when using the -T switch it will output those same statistics in what it calls Table Format which could easily be imported into a spreadsheet or a database. The help output which is displayed below explains all of the different stats available when running capinfos against a cap file.

Backtrack Linux capinfos Help Output:

As you can see from the help output capinfos will provide a bunch of cool info including the cap files MD5, RMD160, and SHA1 hash of the capture file. Using one of the pcap capture files already located on Backtrack lets see the default output of capinfos.

capinfos Default Output: Statistical Info Of Wireless Packet Capture File

The above pcap file is included in the Backtrack Linux 5r3 aircrack-ng installation. You can see that capinfos gets the file encapsulation correct and provides a bunch of other stat information about the file including the number of packets, file size, capture start time, capture end time, the file hash information, the average packet size, and more. Capinfos provides a great overview of a capture file and while the above example only has a single packet you get the idea of the information it is capable of providing.

Now if you only needed a single statistic such as the number of packets in a capture file you could obtain that or any of the other data provided by capinfos by using the switches noted in the help command above. Lets run capinfos against another pcap file thats installed on Backtrack Linux by default to see the number of packets in the file.

Use capinfos To Determine Number Of Packets In A Capture File:

Say you had some form of network logging going on where there were capture files being generated automatically and you needed a nightly report sent to you about those files including the number of packets that had traversed a network segment during a specific time period. You could use capinfos to generate output using the Table Format which would output directly to a spreadsheet or into a database so that data could be easily viewed.