GET /favicon.ico HTTP/1.1 Host: www.packetfactory.net User-Agent: Mozilla/5.0 (X11; U; OpenBSD i386; en-US; rv:1.5a) Gecko/20031030 Mozilla Firebird/0.6.1 Accept: image/png,image/jpeg,image/gif;q=0.2;q=0.1 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: http://www.packetfactory.net/projects/libnids/from this you can get the URL (Host + GET string) and the referrer, meaning you can infer with high confidence how the user surfed there. this still leaves you with some islands, but you can now graphically see website structures and information.
http-graph.ps: http-graph.dot neato -Tps -o http-graph.ps -Nstyle=filled -Nshape=box \ -Ncolor=grey -Elen=3 -Ew=2 http-graph.dotthose weights and lengths balance between graph size and readability.
next Saturday, Oct 02, 2004 @ 06:53am | previous Thursday, Sep 30, 2004 @ 08:26am | archives
|Last modified: Friday, Oct 01, 2004 @ 06:44am|
copyright © 2002-2005 jose nazario, all rights reserved.