Module pcap_to_serializedList
|
|
1
2
3
4
5 """pcap_to_serializedList.py
6
7 Generate a serialized list object from the pcap file.
8
9 This script uses Pylibpcap which is faster than pcapy.
10
11 The object list generated contains the same information as the basis sqlite.
12 """
13
14 __author__ = "Jerome Hussenet, Cedric Bonhomme"
15 __version__ = "$Revision: 0.2 $"
16 __date__ = "$Date: 2009/02/20 $"
17 __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme"
18 __license__ = "Python"
19
20 import pcap
21
22 import socket
23 import struct
24
25 import pickle
26
27
29 """Decode IP packets"""
30 d = {}
31
32
33
34
35
36
37
38
39
40
41 d['source_address'] = pcap.ntoa(struct.unpack('i', s[12:16])[0])
42 d['destination_address'] = pcap.ntoa(struct.unpack('i', s[16:20])[0])
43
44
45
46
47
48 return d
49
51 reader = pcap.pcapObject()
52 reader.open_offline(pcap_file)
53
54 liste_ip = []
55
56 if options.verbose:
57 print "Reading pcap file..."
58 while True:
59 try:
60 (_, payload, tts) = reader.next()
61 except:
62 break
63 if payload[12:14] == '\x08\x00':
64 decoded_ip_packet = decode_ip_packet(payload[14:])
65 liste_ip.append((tts, decoded_ip_packet['source_address'], \
66 decoded_ip_packet['destination_address']))
67
68 if options.verbose:
69 print "Serialization..."
70 liste_obj = open(obj_file, "w")
71 pickle.dump(liste_ip, liste_obj)
72 liste_obj.close()
73
74
75 if __name__ == "__main__":
76
77 from optparse import OptionParser
78 parser = OptionParser()
79 parser.add_option("-i", "--input", dest="pcap_file",
80 help="pcap file")
81 parser.add_option("-o", "--output", dest="objlist_file",
82 help="Python serialized object")
83 parser.add_option("-q", "--quiet",
84 action="store_false", dest="verbose",
85 help="be vewwy quiet (I'm hunting wabbits)")
86 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap',
87 objlist_file = './data/list.pyobj',
88 verbose = True)
89
90 (options, args) = parser.parse_args()
91
92 pcap_to_serializedList(options.pcap_file, options.objlist_file)
93