Stream Reconstruction | 39
Chapter 7: Stream Reconstruction
Reconstructing streams of HTTP, VoIP, and more
Note:
Stream reconstruction (including VoIP) is illegal in some jurisdictions and may be disabled by Network
Instrumentsto comply with those laws.
The process of capturing and reconstructing traffic is pretty much the same regardless of traffic type. Use these
steps to reconstruct the stream. The process described here is for reconstructing HTTP, but the process is the
same for other applications, except instep 6 you would choose the appropriate menu option.
1. Isolate the time frame in the Detail Chart you want to analyze. See
Selecting a time frame to analyze
.
2. (Optional) Using the various Statistics tabs, select IP Stations tab and choose the station(s) you want to
isolate. This creates a filter.
3. Click Update Chart. This updates the Detail Chart and shows you all of the traffic from the address.
4. You can further filter the chart and reports by selecting specific traffic types (for example, HTTP, SMTP,
Telnet, and so on).
5. Analyze the data using one of the options described in
Mining data from your GigaStor
. This opens your data
in the Decode tab in the Observer analyzer.
6. Assuming the data is HTTP, select a packet in the Decode tab and right-click. Choose TCP Dump (HTTP) from
the menu. This analyzes the data and opens it in the Expert tab.
7. Scroll through the decoded packets. Click the “ReconstructedPage.html” files to see the web page as it
looked when the user saw it.
Defining what can be recreated in Stream Reconstruction
Note:
Stream reconstruction (including VoIP) is illegal in some jurisdictions and may be disabled by Network
Instrumentsto comply with those laws.
For security or privacy reasons or because of company policy, you may need to limit what the GigaStor probe
can recreate through its stream reconstruction feature.
1. Choose Capture > GigaStor Control Panel.