HTTP Traffic Analyzer

This application analyzes HTTP traffic and presents detailed and diverse information about it such as:

Packet count and rate
Bandwidth
Flow count and rate
HTTP requests + responses count and rate
HTTP transaction count and rate
HTTP pipelining count
HTTP header size
Hostname histogram
Content-type histogram
Status code histogram

It can analyze live traffic or read packets from a pcap/pcap-ng file

The output stats looks as follows:

STATS SUMMARY
=============
General stats
--------------------
Sample time:                                     18.374 [Seconds]
Number of HTTP packets:                            5662 [Packets]
Rate of HTTP packets:                           291.910 [Packets/sec]
Number of HTTP flows:                                55 [Flows]
Rate of HTTP flows:                               2.836 [Flows/sec]
Number of HTTP pipelining flows:                      0 [Flows]
Number of HTTP transactions:                        322 [Transactions]
Rate of HTTP transactions:                       16.601 [Transactions/sec]
Total HTTP data:                                5916120 [Bytes]
Rate of HTTP data:                           305011.600 [Bytes/sec]
Average packets per flow:                       102.945 [Packets]
Average transactions per flow:                    5.963 [Transactions]
Average data per flow:                       107565.818 [Bytes]
HTTP request stats
--------------------
Number of HTTP requests:                            323 [Requests]
Rate of HTTP requests:                           16.653 [Requests/sec]
Total data in headers:                           188596 [Bytes]
Average header size:                            583.889 [Bytes]
HTTP response stats
--------------------
Number of HTTP responses:                           332 [Responses]
Rate of HTTP responses:                          17.117 [Responses/sec]
Total data in headers:                           119577 [Bytes]
Average header size:                            360.172 [Bytes]
Num of responses with content-length:               320 [Responses]
Total body size (may be compressed):            5409410 [Bytes]
Average body size:                            16904.406 [Bytes]
HTTP request methods
--------------------
| Method    | Count |
---------------------
| GET       | 321   |
| POST      | 2     |
---------------------
Hostnames count
--------------------
| Hostname                                 | Count |
----------------------------------------------------
| images1.teny.co.qq                       | 180   |
| www.teny.co.qq                           | 82    |
| go.teny.co.qq                            | 14    |
| www.niwwin.co.qq                         | 8     |
| az835984.vo.msecnd.net                   | 5     |
| asset.pagefair.com                       | 3     |
| b.scorecardresearch.com                  | 3     |
| cdn.oolala.com                           | 3     |
| asset.pagefair.net                       | 2     |
| dy2.teny.co.qq                           | 2     |
| ecdn.firstimpression.io                  | 2     |
| pagead2.googlesyndication.com            | 2     |
| server.exposebox.com                     | 2     |
| totalmedia2.teny.co.qq                   | 2     |
| vrp.mybrain.com                          | 1     |
| trc.oolala.com                           | 1     |
| zdwidget3-bs.sphereup.com                | 1     |
| vrt.mybrain.com                          | 1     |
| www.googletagmanager.com                 | 1     |
| a.visualrevenue.com                      | 1     |
| tpc.googlesyndication.com                | 1     |
| static.dynamicyield.com                  | 1     |
| st.dynamicyield.com                      | 1     |
| sf.exposebox.com                         | 1     |
| mediadownload.teny.co.qq                 | 1     |
| cdn.firstimpression.io                   | 1     |
| ajax.googleapis.com                      | 1     |
----------------------------------------------------
Status code count
--------------------
| Status Code                  | Count |
----------------------------------------
| 200 OK                       | 327   |
| 204 No Content               | 1     |
| 301 Moved Permanently        | 1     |
| 302 Moved Temporarily        | 1     |
| 304 Not Modified             | 2     |
----------------------------------------
Content-type count
--------------------
| Content-type                   | Count |
------------------------------------------
| application/javascript         | 11    |
| application/json               | 1     |
| application/x-javascript       | 23    |
| image/gif                      | 22    |
| image/jpeg                     | 157   |
| image/png                      | 85    |
| text/css                       | 9     |
| text/html                      | 8     |
| text/javascript                | 13    |
------------------------------------------

Using the utility

When analyzing HTTP traffic from a pcap/pcap-ng file:

Basic usage:
	HttpAnalyzer [-h] -f input_file
Options:
	-f           : The input pcap file to analyze. Required argument for this mode
	-h           : Displays this help message and exits

When analyzing HTTP traffic on live traffic:

Basic usage:
	HttpAnalyzer [-hld] [-o output_file] [-r calc_period] [-p dst_port] -i interface
Options:
	-i interface   : Use the specified interface. Can be interface name (e.g eth0) or interface IPv4 address
	-p dst_port    : Use the specified port (optional parameter, the default is 80)
	-o output_file : Save all captured HTTP packets to a pcap file. Notice this may cause performance degradation
	-r calc_period : The period in seconds to calculate rates. If not provided default is 2 seconds
	-d             : Disable periodic rates calculation
	-h             : Displays this help message and exits
	-l             : Print the list of interfaces and exists