MMT-HTTP

• Simple version of MMT Tool
• Provide HTTP informations in your network such as: method, url, cookies, user-agent
• OS supported: Linux, macOS

Install

Make sure you have installed MMT-DPI

Install some dependencies

To compile MMTReader, we need to install libpcap-dev and libconfuse-dev:

On Debian machine

sudo -s
apt-get update
# C/C++ environment
apt-get install -y build-essential gcc g++ make
apt-get update
apt-get install libpcap-dev libconfuse-dev

On Redhat machine

yum update
# C/C++ environment
yum group install "Development Tools"
yum install libpcap-devel

Compile MMT-HTTP

Using Makefile (Recommended)

The provided Makefile automatically detects your OS and uses the appropriate compiler:

make

Manual Compilation

Linux:

gcc -g -o mmtHTTP mmtHTTP.c -I /opt/mmt/dpi/include -L /opt/mmt/dpi/lib -lmmt_core -ldl -lpcap

macOS:

clang -g -o mmtHTTP mmtHTTP.c -I /opt/mmt/dpi/include -L /opt/mmt/dpi/lib -lmmt_core -ldl -lpcap -Wl,-rpath,/opt/mmt/dpi/lib

From MMT workspace:

# Linux
gcc -g -o mmtHTTP mmtHTTP.c -I ../mmt-dpi/sdk/include -L ../mmt-dpi/sdk/lib -lmmt_core -ldl -lpcap

# macOS
clang -g -o mmtHTTP mmtHTTP.c -I ../mmt-dpi/sdk/include -L ../mmt-dpi/sdk/lib -lmmt_core -ldl -lpcap -Wl,-rpath,../mmt-dpi/sdk/lib

Running MMT-HTTP

macOS Setup (Important!)

Before running on macOS, you must set both environment variables:

# If installed to /opt/mmt/dpi
export MMT_PLUGINS_PATH=/opt/mmt/dpi/lib
export DYLD_LIBRARY_PATH=/opt/mmt/dpi/lib:$DYLD_LIBRARY_PATH

# If running from MMT workspace
export MMT_PLUGINS_PATH=$(pwd)/../mmt-dpi/sdk/lib
export DYLD_LIBRARY_PATH=$(pwd)/../mmt-dpi/sdk/lib:$DYLD_LIBRARY_PATH

Usage:

From pcap file:

./mmtHTTP -t [PATH_TO_PCAP_FILE] <OPTION>

From live interface:

# Linux
sudo ./mmtHTTP -i [INTERFACE_NAME] <OPTION>

# macOS (common interface names: en0, en1)
sudo ./mmtHTTP -i en0 <OPTION>

Options:

 -b [value] : Set buffer for pcap handler in realtime monitoring

 -h         : Show help

Important Notes

HTTP vs HTTPS Traffic:

• This tool analyzes plain HTTP traffic only (port 80, unencrypted)
• HTTPS traffic (port 443, encrypted) cannot be analyzed as it's encrypted
• Most modern websites use HTTPS, so live capture may show zero HTTP statistics
• For testing, use pcap files containing HTTP traffic or access plain HTTP sites

Issues

If you have any problem, please contact us at: contact@montimage.com

License

Copyright Montimage