Module pcap_to_object
[hide private]
[frames] | no frames]

Source Code for Module pcap_to_object

 1  #! /usr/local/bin/python 
 2  #-*- coding: utf-8 -*- 
 3   
 4  """pcap_to_object 
 5   
 6  Generate a serialized graph object from a pcap file. 
 7  """ 
 8   
 9  __author__ = "Jerome Hussenet, Cedric Bonhomme" 
10  __version__ = "$Revision: 0.2 $" 
11  __date__ = "$Date: 2009/02/19 $" 
12  __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme" 
13  __license__ = "Python" 
14   
15  import os 
16  import sys 
17   
18  import pickle 
19   
20  import pcapy 
21  import impacket.ImpactDecoder as Decoders 
22  import impacket.ImpactPacket as Packets 
23   
24   
25 -def pcap_to_object(pcap_file, obj_file):
26 """Create a Python serialized graph object. 27 28 Read the pcap file given in parameter, extracts source and destination IP 29 and write a serialized graph object. 30 """ 31 reader = pcapy.open_offline(pcap_file) 32 eth_decoder = Decoders.EthDecoder() 33 ip_decoder = Decoders.IPDecoder() 34 35 dic_ip = {} 36 37 tts_min = 1000 38 tts_max = 2000 39 40 if options.verbose: 41 print "Reading pcap file..." 42 while True: 43 try: 44 (header, payload) = reader.next() 45 if tts_min <= header.getts()[0] <= tts_max: 46 ethernet = eth_decoder.decode(payload) 47 if ethernet.get_ether_type() == Packets.IP.ethertype: 48 ip = ip_decoder.decode(payload[ethernet.get_header_size():]) 49 ip_src = ip.get_ip_src() 50 ip_dst = ip.get_ip_dst() 51 if ip_src not in dic_ip: 52 dic_ip[ip_src] = {} 53 dic_ip[ip_src][ip_dst] = 1 54 else: 55 if ip_dst not in dic_ip[ip_src]: 56 dic_ip[ip_src][ip_dst] = 1 57 else: 58 dic_ip[ip_src][ip_dst] += 1 59 except: 60 break 61 62 if options.verbose: 63 print "Serialization..." 64 dic_obj = open(obj_file, "w") 65 pickle.dump(dic_ip, dic_obj) 66 dic_obj.close()
67 68 69 if __name__ == "__main__": 70 # Point of entry in execution mode. 71 from optparse import OptionParser 72 parser = OptionParser() 73 parser.add_option("-i", "--input", dest="pcap_file", 74 help="pcap file") 75 parser.add_option("-o", "--output", dest="obj_file", 76 help="Python serialized object") 77 parser.add_option("-q", "--quiet", 78 action="store_false", dest="verbose", 79 help="be vewwy quiet (I'm hunting wabbits)") 80 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap', 81 obj_file = './data/dic.pyobj', 82 verbose = True) 83 84 (options, args) = parser.parse_args() 85 86 pcap_to_object(options.pcap_file, options.obj_file) 87