1
2
3
4 """pcap_to_sqlite
5
6 Generate the SQLite base from the pcap file.
7 """
8
9 __author__ = "Jerome Hussenet, Cedric Bonhomme"
10 __version__ = "$Revision: 0.1 $"
11 __date__ = "$Date: 2009/02/19 $"
12 __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme"
13 __license__ = "Python"
14
15 import os
16 import sys
17
18 import pcapy
19 import impacket.ImpactDecoder as Decoders
20 import impacket.ImpactPacket as Packets
21
22 import sqlite3
23
24
26 """Generate the SQLite base.
27
28 Read the pcap file given in parameter, extracts source and destination IP
29 and create the SQLite base.
30 """
31 reader = pcapy.open_offline(pcap_file)
32 eth_decoder = Decoders.EthDecoder()
33 ip_decoder = Decoders.IPDecoder()
34
35 if options.verbose:
36 print "Reading pcap file..."
37 liste = []
38 while True:
39 try:
40 (header, payload) = reader.next()
41 ethernet = eth_decoder.decode(payload)
42 if ethernet.get_ether_type() == Packets.IP.ethertype:
43 ip = ip_decoder.decode(payload[ethernet.get_header_size():])
44 liste.append((str(header.getts()), ip.get_ip_src(), ip.get_ip_dst()))
45 except:
46 break
47
48 conn = sqlite3.connect(sqlite_file)
49 c = conn.cursor()
50
51 if options.verbose:
52 print "Creating table."
53 c.execute('''create table ip_link
54 (tts real, ip_src text, ip_dst text)''')
55
56 if options.verbose:
57 print "Inserting values in the table..."
58 for t in liste:
59 c.execute('insert into ip_link values (?,?,?)', t)
60
61 conn.commit()
62 c.close()
63
64
65 if __name__ == "__main__":
66
67 from optparse import OptionParser
68 parser = OptionParser()
69 parser.add_option("-i", "--input", dest="pcap_file",
70 help="pcap file")
71 parser.add_option("-o", "--output", dest="sqlite_file",
72 help="SQLite base")
73 parser.add_option("-q", "--quiet",
74 action="store_false", dest="verbose",
75 help="be vewwy quiet (I'm hunting wabbits)")
76 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap',
77 sqlite_file = './data/ip.sql',
78 verbose = True)
79
80 (options, args) = parser.parse_args()
81
82 pcap_to_sqlite(options.pcap_file, options.sqlite_file)
83