Home

This is the official homepage for PacketQ, a simple tool to make SQL-queries agains PCAP-files, making packet-analysis and building statistics simple and quick. PacketQ was previously know as DNS2db but was renamed in 2011 when it was rebuilt and could handle other protocols than DNS among other things.

Basics

Look how easy it's to count DNS-packets in a PCAP-file.

# packetq -s "select count(*) as count_dns from dns" packets.pcap 
[
  {
    "table_name": "result",
    "head": [
      { "name": "count_dns","type": "int" }
    ],
    "data": [
[95501]
    ]
  }
]

Read more in our FAQ and Examples section below.

Features

• Super-fast native decoding of PCAP-files (even gzipped) and dirt-quick in-memory sorting algorithms.
• A extensible protocol decoding design with build in support for ICMP and DNS from start.
• Support for grouping, sorting, counting and most other important SQL-functions.
• Only dependent on zlib, no other hard-to-find libs needed. Compiles on everything.
• Build-in web-server, JSON API and a simple JQuery-based GUI concept application with graphs.
• Can be designed to cache queries by pre-processing PCAPs into static JSON-files that can be used to make queries again.
• Built in DNS-resolver function (used by GUI).
• Support for sampling. Helps when making queries to large, uniform PCAP-files.
• Can convert flags in packet-headers to text on the fly.
• Can make multiple queries towards the same data in memory.

See Functions

FAQ and Examples

Does PacketQ conform to the SQL standard ?

The short answer is no. Packet implements an SQL like select function with some notable omissions like:

• No 3 value logic i.e. theres no special NULL value
• No supports for joins or subqueries
• No support for the distinct keyword
• No support for like in where statements

Refer to the file grammar for supported statements.

How do I return full packetdata for the first 3 dns packets?

Use this SQL-statement.

# packetq -s "select * from dns limit 3" packets.pcap 

How do I check which domain-name (qname) is queried the most?

# packetq -s "select qname,count(*) as count from dns group by qname order by count desc limit 1 " packets.pcap
[ 
{ "table_name": "result",
    "head": [
      { "name": "qname","type": "text" },
      { "name": "count","type": "int" }
    ],
    "data": [ ["se.",2747]  ]
  }
]

How do I check which server that makes the most queries?

# packetq -s "select src_addr,count(*) as count from dns group by src_addr order by count desc limit 1" packets.pcap 
[
  {
    "table_name": "result",
    "head": [
      { "name": "src_addr","type": "text" },
      { "name": "count","type": "int" }
    ],
    "data": [
["::127.0.0.1",1849]
    ]
  }
]

I have 90000000 packets in a file, how can I processes every 1000th packet?

By using the sample-keyword before the actual query, it selects only every Xth packet. The amount of time saved by this command will be different on different systems, at some point the time it takes to read the file from disk will be longer than the time spent on processing. In other words, the full file will have to be read from disk regardless. This command also saved RAM.

# ./packetq -s "sample 1000; select count(*) from dns" ~/pcap/* 
[  {
    "table_name": "result",
    "head": [ { "name": "count(1)","type": "int" }],
    "data": [ [90000]] }]

How do I extract parts of the qname and group using this, like the domain-name?

Using the rsplit-function you can split values based on chars (like the dot). This query extract the two lowest levels (the domain for the .se-zone) and makes a top-10 list.

# packetq -s "select count(*) as Count, lower(rsplit(qname,2)||'.'||rsplit(qname,1)) as Domain from dns group by domain order by count desc limit 10" peak/07/G.ns.se-20110408-074500-em0.gz
[
  {
    "table_name": "result",
    "head": [
      { "name": "Count","type": "int" },
      { "name": "Domain","type": "text" }
    ],
    "data": [
[5130,"pp.se"],
[1686,"netnod.se"],
[1448,".se"],
[1318,"domainnetwork.se"],
[936,"ballou.se"],
[867,"loopia.se"],
[784,"ns.se"],
[736,"sonera.se"],
[694,"digidns.se"],
[639,"prq.se"]
    ]
  }
]