# Convert man pages to pdf
man2pdf()
{
m2pfile="/tmp/${1}-m2p.pdf"
if [ ! -s $m2pfile ]; then # is it there and > zero bytes 
     man -t "${1}" | ps2pdf - > "$m2pfile"
     fsize=`du -k $m2pfile | awk '{print $1}'`
     echo "Created PDF file in $m2pfile ($fsize KB)"
fi
}


It can trivially be extended to check for things like a $DISPLAY variable and pop up a viewer or request to print. The caching is admittedly crude, but works since /tmp is cleared out periodically. Output looks like:

[bvi@starburst ~]$ man2pdf ls
Created PDF file in /tmp/ls-m2p.pdf (20 KB)

FreeBSD ports are still holding 4.90RC1 form 10 days ago, but are likely to get updated soon.

xsltproc map2.xsl asia.xml

given the input from the Asia attack  graph produces:

30-06-2009 05:00:17 GMT,RU,Russia,15387,green
30-06-2009 05:00:17 GMT,TR,Turkey,7137,green
30-06-2009 05:00:17 GMT,CN,China,2468,green
30-06-2009 05:00:17 GMT,MY,Malaysia,4158,green
30-06-2009 05:00:17 GMT,IN,India,2631,green
30-06-2009 05:00:17 GMT,TH,Thailand,1823,green

While not the most elegant code, its gets done what I need, and is easily extensible enough to be able to  transform to other formats suitable for DB import. I’ll need to monitor data over the next couple of days to get an idea as to how the counters used are actually operating. Once that has been established I can star doing some meaningful comparisons.

• tcpreplay is now at version 3.4.0 with a number of significant bugfixes. This staple of packet analysis allows for the replay of captured pcap file back over network interfaces.  Its a great way of having a repeatable test framework, or for explosing yout NIDS system to collected bad traffic.
• picviz 0.5 has been released. I blogged about this before and the project seems to be comming on nicely. Formy own purposes its not much use with my network telescope data, but does produce some pretty pictures for some other work Ive been doing of late. The new version comes with a bumber of new log parsers. A slide deck discussing its use as presented at USENIX 2008 is also available.
• pcapr is the new tool out and describes itself as “web 2.0 meets packets“, and “pcapr does to packets what flickr does to pictures”. If it performs as promised it could make life a lot easier maintinaing libraries of packet captures. The fact its a hosted service does have some distinct disadvantages. Currently there seems to be quote a lot of little snippets. An RSS feed of new content is also available.  Another similar repository s that of openpacket.org
• libtrace while not a new tool as such, is somethign I’ve started workign with recentlyafter comming across it in Dean Pemberton’s MSc Thesis2007 on Internet Background Radiation Arrival Density and Network Telescope Sampling Strategies. The api looks pretty clean and it comes with a couple of nice demo tools which are actually useful.  the URI syntax it uses for accessing files is a little strange but managable.

A more advanced version of the kind of output achievable is also provided showing how with the help of a pre-processing script, the SSH login process can be graphed:

Graphs are produced via an intermediate scripting language which has by design strong similarity to that used by Graphviz.  I’ll definatley be adding this to my toolset and seeing how it handles processing of some of the rather large data sets Ive got.