Xplico

Key takeaways

Xplico belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Xplico to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Xplico from memory before moving on to harder problems.

Reference excerpt

Xplico is a network forensics analysis tool (NFAT), which is a software that reconstructs the contents of acquisitions performed with a packet sniffer (e.g. Wireshark, tcpdump, Netsniff-ng). Unlike the protocol analyzer, whose main characteristic is not the reconstruction of the data carried out by the protocols, Xplico was born expressly with the aim to reconstruct the protocol's application data and it is able to recognize the protocols with a technique named Port Independent Protocol Identification (PIPI). The name "xplico" refers to the Latin verb explico and its significance. Xplico is free and open-source software, subject to the requirements of the GNU General Public License (GPL), version 2.

Overview Using raw data from Ethernet or PPP of a web navigation (HTTP protocol), Xplico extracts application data and reconstructs the contents within a packet. In the case of HTTP protocol: images, files, or cookies would be extracted. Similarly Xplico is able to reconstruct the e-mail exchanged with the IMAP, POP, and SMTP protocols. Among the protocols that Xplico identifies and reconstructs there are VoIP, MSN, IRC, HTTP, IMAP, POP, SMTP, and FTP.

Features

Software architecture The Xplico's software architecture provides:

an input module to handle data input (from probes or packet sniffer) an output module to organize the decoded data and presenting them to the end user; and a set of decoding modules, called protocol dissector for the decoding of the individual network protocol. With the output module Xplico can have different user interfaces, in fact it can be used from command line and from a web user interface called "Xplico Interface". The protocol dissector is the modules for the decoding of the individual protocol, each protocol dissector can reconstruct and extract the data of the protocol. All modules are plug-in and, through the configuration file, they can be loaded or not during execution of the program. This allows to focus the decoding, that is, if you want to decode only VoIP calls but not the Web traffic then you configure Xplico to load only the RTP and SIP modules excluding the HTTP module.

Large scale pcap data analysis Another feature of Xplico is its ability to process (reconstruct) huge amounts of data: it is able to manage pcap files of multiple gigabytes and even terabytes from multiple capture probes simultaneously. This is thanks to the use of various types of "input modules". The pcap files can be uploaded in many ways, directly from the Xplico Web user interface, with a SFTP or with a transmission channel called PCAP-over-IP. For these features Xplico is used in the contexts of Lawful interception and in Network Forensics.

VoIP calls Xplico and also its specific version called pcap2wav is able to decode VoIP calls based on the RTP protocol (SIP, H323, MGCP, SKINNY) and supports the decodidica of audio codecs G711ulaw, G711alaw, G722, G729, G723, G726, and MSRTA (Microsoft's Real-time audio).

Basic commands working from command line In these examples, it is assumed that eth0 is the used network interface.

real-time acquisition and decoding: xplico -m rltm -i eth0

decoding of a single pcap file: xplico -m pcap -f example.pcap

decoding a directory which contains many files pcap xplico -m pcap -d /path/dir/

in all cases the data decoded are stored in the a directory named xdecode. With the parameter -m we can select the "input module" type. The input module named rltm acquires the data directly from the network interface, vice versa the input module named pcap acquires data form pcap files or directory.

Distributions Xplico is installed by default in the major distributions of digital forensics and penetration testing:

Kali Linux, BackTrack, DEFT, Security Onion Matriux BackBox CERT Linux Forensics Tools Repository.

See also Comparison of packet analyzers tcpdump, a packet analyzer pcap, an application programming interface (API) for capturing network traffic snoop, a command line packet analyzer included with Solaris wireshark, a network packet analyzer dsniff, a packet sniffer and set of traffic analysis tools netsniff-ng, a free Linux networking toolkit ngrep, a tool that can match regular expressions within the network packet payloads etherape, a network mapping tool that relies on sniffing traffic tcptrace, a tool for analyzing the logs produced by tcpdump

References

External links Official website Xplico Demo Cloud PCAP2WAV and RTP2WAV Demo Cloud

Worked examples

Example 1 — a first encounter with Xplico

Start with the simplest possible case. Write down what Xplico claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Xplico before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Xplico ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Xplico

In research: Xplico appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Xplico in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Xplico is common in secondary-school and first-year university syllabi. It links to neighbouring topics Free network management software, Free software programmed in C, Linux-only free software, so understanding it makes those chapters shorter.
In everyday life: Look for Xplico outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Xplico in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Xplico means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Xplico out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Xplico in simple terms?

Xplico is a network forensics analysis tool (NFAT), which is a software that reconstructs the contents of acquisitions performed with a packet sniffer (e.g. Wireshark, tcpdump, Netsniff-ng).

Why does Xplico matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Xplico?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Xplico.