http - Identify single communication -

i have problem identifying communication established tcp. have identify first completed communication, example first complete http communication. have dump .pcap file capture. know communication should start 3 way handshake ( syn, syn - ack, ack ) , closing of communication double fin flag both side.

but have lot of communication in dump file. here question. things need remember match exact 1 communication ?

i thought source ip, destination ip, protocol, maybe port not sure.

thank every advice. , sorry english.

you stated need:

1. to identify particular conversation
2. to identify first completed conversation

you can identify particular tcp or udp conversation filtering 5-tuple of connection:

1. source ip
2. source port
3. destination ip
4. destination port
5. transport (tcp or udp)

as shane mentioned, protocol dependent e.g. icmp not have concept of ports tcp , udp do.

a libpcap filter following work tcp , udp:

tcp , host 1.1.1.1 , port 53523 , dst ip 1.1.1.2 , port 80 

apply tcpdump:

$ tcpdump -nnr myfile.pcap 'tcp , host 1.1.1.1 , port 53523 , dst ip 1.1.1.2 , port 80' 

to identify first completed connection have follow timestamps.

using tool bro read pcap yield answer list each connection attempt seen (complete or incomplete):

$ bro -r myfile.pcap $ bro-cut -d < conn.log | head -1 2014-03-14t10:00:09-0500    cpnl844qkzabychil7  1.1.1.1 57596   1.1.1.2 80  tcp http    0.271392    248 7775    sf  f   shadadff    14  1240    20  16606   (empty)  

use flag data tcp judge whether there successful handshake , tear down. other protocols can make judgements based on byte counts, sent , received.