Module pcap_to_sqlite
[hide private]
[frames] | no frames]

Source Code for Module pcap_to_sqlite

 1  #! /usr/local/bin/python 
 2  #-*- coding: utf-8 -*- 
 3   
 4  """pcap_to_sqlite 
 5   
 6  Generate the SQLite base from the pcap file. 
 7  """ 
 8   
 9  __author__ = "Jerome Hussenet, Cedric Bonhomme" 
10  __version__ = "$Revision: 0.1 $" 
11  __date__ = "$Date: 2009/02/19 $" 
12  __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme" 
13  __license__ = "Python" 
14   
15  import os 
16  import sys 
17   
18  import pcapy 
19  import impacket.ImpactDecoder as Decoders 
20  import impacket.ImpactPacket as Packets 
21   
22  import sqlite3 
23   
24   
25 -def pcap_to_sqlite(pcap_file, sqlite_file):
26 """Generate the SQLite base. 27 28 Read the pcap file given in parameter, extracts source and destination IP 29 and create the SQLite base. 30 """ 31 reader = pcapy.open_offline(pcap_file) 32 eth_decoder = Decoders.EthDecoder() 33 ip_decoder = Decoders.IPDecoder() 34 35 if options.verbose: 36 print "Reading pcap file..." 37 liste = [] 38 while True: 39 try: 40 (header, payload) = reader.next() 41 ethernet = eth_decoder.decode(payload) 42 if ethernet.get_ether_type() == Packets.IP.ethertype: 43 ip = ip_decoder.decode(payload[ethernet.get_header_size():]) 44 liste.append((str(header.getts()), ip.get_ip_src(), ip.get_ip_dst())) 45 except: 46 break 47 48 conn = sqlite3.connect(sqlite_file) 49 c = conn.cursor() 50 51 if options.verbose: 52 print "Creating table." 53 c.execute('''create table ip_link 54 (tts real, ip_src text, ip_dst text)''') 55 56 if options.verbose: 57 print "Inserting values in the table..." 58 for t in liste: 59 c.execute('insert into ip_link values (?,?,?)', t) 60 61 conn.commit() 62 c.close()
63 64 65 if __name__ == "__main__": 66 # Point of entry in execution mode. 67 from optparse import OptionParser 68 parser = OptionParser() 69 parser.add_option("-i", "--input", dest="pcap_file", 70 help="pcap file") 71 parser.add_option("-o", "--output", dest="sqlite_file", 72 help="SQLite base") 73 parser.add_option("-q", "--quiet", 74 action="store_false", dest="verbose", 75 help="be vewwy quiet (I'm hunting wabbits)") 76 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap', 77 sqlite_file = './data/ip.sql', 78 verbose = True) 79 80 (options, args) = parser.parse_args() 81 82 pcap_to_sqlite(options.pcap_file, options.sqlite_file) 83