How to Utilize the `sc_wartsfilter` Command (with Examples)

sc_wartsfilter is a specialized tool used within the network analysis community, specifically for processing warts files. These files are generated by scamper, a utility often employed to perform traceroute-like measurements, ping tests, and other network probing activities. The sc_wartsfilter command assists in extracting specific records from these warts files, based on criteria such as destination address or action type, enhancing the user’s ability to analyze precise segments of data relevant to their needs.

Use case 1: Filter all data records that had specific destinations and write them to a separate file

Code:

sc_wartsfilter -i path/to/input.warts -o path/to/output.warts -a 192.0.2.5 -a 192.0.2.6

Motivation:

In many network analysis scenarios, researchers and practitioners need to focus their attention on particular destinations within the network. These could be servers of interest, critical infrastructural nodes, or points suspected to be involved in problematic behavior. By filtering records with specific destination addresses, one can hone in on the most relevant data, making it much easier to conduct detailed investigations or monitor critical nodes.

Explanation:

• -i path/to/input.warts: This argument specifies the input warts file from which data needs to be filtered. It directs the command to the source of the network records.

• -o path/to/output.warts: This designates the output warts file where the filtered records will be stored. The command processes the input and spits out a new, more focused file.

• -a 192.0.2.5 -a 192.0.2.6: These flags specify the destination IP addresses of interest. In this instance, records with these particular addresses will be selected and written into the output file.

Example Output:

Imagine running this command on a warts file containing 10,000 network traces. If 500 of these traces have the destination 192.0.2.5 or 192.0.2.6, the output file will exclusively contain these 500 records.

Use case 2: Filter all records that had certain destinations in a prefix and write them to a separate file

Code:

sc_wartsfilter -i path/to/input.warts -o path/to/output.warts -a 2001:db8::/32

Motivation:

Network administrators and analysts often need to consider broad swathes of possible destination addresses, particularly when observing traffic trends or analyzing the spread of an event within a subnet. The ability to filter records by prefix allows analysts to evaluate traffic patterns over an entire range of IPs, which is vital for gauging wider network phenomena or ensuring compliance with network policies.

Explanation:

• -i path/to/input.warts: This indicates the file containing the network records to be filtered.

• -o path/to/output.warts: This specifies where the filtered data will be outputted, allowing for easy examination or further processing.

• -a 2001:db8::/32: With this argument, the command fetches all records with destinations that fall within the specified IPv6 prefix. This is crucial for fetching data related to an entire segment of the network.

Example Output:

Suppose the input file documents traffic from a vast IPv6 address range, and 7,000 records fall within the 2001:db8::/32 subnet. Running this command isolates these records into a new file, making it easier to perform subnet-specific analysis.

Use case 3: Filter all records using a specific action and output them as JSON

Code:

sc_wartsfilter -i path/to/input.warts -t ping | sc_warts2json

Motivation:

Analyzing network data in different formats is paramount for integrative studies and interoperability with various network analysis tools. JSON is a flexible, widely supported format that is easier to manipulate and read programmatically compared to warts. Converting warts to JSON after filtering enhances accessibility and allows incorporation into broader data frameworks or systems that may only understand JSON input.

Explanation:

• -i path/to/input.warts: This flags the input file which contains the data you’re interested in.

• -t ping: This specifies the action type of interest, which in this case is ‘ping’. The command will filter and output records corresponding to ping actions.

• | sc_warts2json: The pipeline symbol (|) passes the filtered data to sc_warts2json, a command that converts the warts format into JSON, a more modern and flexible format.

Example Output:

When you run this command, the output is a plethora of JSON objects, each representing a record corresponding to a ‘ping’ action in the input file. The output data is structured and easy to accommodate in applications or analytics software that handles JSON.

Conclusion:

The sc_wartsfilter command is a powerful tool for narrowing down network measurements from warts files, allowing researchers and administrators to focus on specific destinations, prefixes, or action types. These capabilities are invaluable in network diagnostics, performance monitoring, and troubleshooting, offering a strategic advantage in managing complex network environments.