1
2
3
4 """pcap_to_object
5
6 Generate a serialized graph object from a pcap file.
7 """
8
9 __author__ = "Jerome Hussenet, Cedric Bonhomme"
10 __version__ = "$Revision: 0.2 $"
11 __date__ = "$Date: 2009/02/19 $"
12 __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme"
13 __license__ = "Python"
14
15 import os
16 import sys
17
18 import pickle
19
20 import pcapy
21 import impacket.ImpactDecoder as Decoders
22 import impacket.ImpactPacket as Packets
23
24
26 """Create a Python serialized graph object.
27
28 Read the pcap file given in parameter, extracts source and destination IP
29 and write a serialized graph object.
30 """
31 reader = pcapy.open_offline(pcap_file)
32 eth_decoder = Decoders.EthDecoder()
33 ip_decoder = Decoders.IPDecoder()
34
35 dic_ip = {}
36
37 tts_min = 1000
38 tts_max = 2000
39
40 if options.verbose:
41 print "Reading pcap file..."
42 while True:
43 try:
44 (header, payload) = reader.next()
45 if tts_min <= header.getts()[0] <= tts_max:
46 ethernet = eth_decoder.decode(payload)
47 if ethernet.get_ether_type() == Packets.IP.ethertype:
48 ip = ip_decoder.decode(payload[ethernet.get_header_size():])
49 ip_src = ip.get_ip_src()
50 ip_dst = ip.get_ip_dst()
51 if ip_src not in dic_ip:
52 dic_ip[ip_src] = {}
53 dic_ip[ip_src][ip_dst] = 1
54 else:
55 if ip_dst not in dic_ip[ip_src]:
56 dic_ip[ip_src][ip_dst] = 1
57 else:
58 dic_ip[ip_src][ip_dst] += 1
59 except:
60 break
61
62 if options.verbose:
63 print "Serialization..."
64 dic_obj = open(obj_file, "w")
65 pickle.dump(dic_ip, dic_obj)
66 dic_obj.close()
67
68
69 if __name__ == "__main__":
70
71 from optparse import OptionParser
72 parser = OptionParser()
73 parser.add_option("-i", "--input", dest="pcap_file",
74 help="pcap file")
75 parser.add_option("-o", "--output", dest="obj_file",
76 help="Python serialized object")
77 parser.add_option("-q", "--quiet",
78 action="store_false", dest="verbose",
79 help="be vewwy quiet (I'm hunting wabbits)")
80 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap',
81 obj_file = './data/dic.pyobj',
82 verbose = True)
83
84 (options, args) = parser.parse_args()
85
86 pcap_to_object(options.pcap_file, options.obj_file)
87