Article Figure 1 Figure 2 Listing 1 Listing 2
Listing 3 Listing 4 Listing 5 Listing 6 Listing 7
Listing 8 sep2006.tar

Listing 2 Calculating the total data size

# tcpdump -r /tmp/http.pcap | perl -e '$t=0;while(<>){ chomp; \
  if( /:\s[\w|\.]\s\d+:\d+\((\d+)\)/ ){ $t = $t + $1;  } } print "Total: $t\n";'
reading from file /tmp/http.pcap, link-type EN10MB (Ethernet)
Total: 28002
# tail /var/log/apache/access.log
192.168.239.1 - - [01/May/2006:11:48:34 +0200] "GET / HTTP/1.1" 200 5258 "-" \
  "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2" "-"
192.168.239.1 - - [01/May/2006:11:48:34 +0200] "GET /icons/jhe061.png HTTP/1.1" 200 16405 \
  "http://192.168.239.128/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) \
  Gecko/20060308 Firefox/1.5.0.2" "-"
192.168.239.1 - - [01/May/2006:11:48:34 +0200] "GET /icons/debian/openlogo-25.jpg HTTP/1.1" \
  200 1258 "http://192.168.239.128/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) \
  Gecko/20060308 Firefox/1.5.0.2" "-"
192.168.239.1 - - [01/May/2006:11:48:34 +0200] "GET /icons/apache_pb.png HTTP/1.1" 200 2142 \
  "http://192.168.239.128/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.2) \
  Gecko/20060308 Firefox/1.5.0.2" "-"