Module pcap_to_object1
[hide private]
[frames] | no frames]

Source Code for Module pcap_to_object1

  1  #! /usr/local/bin/python 
  2  #-*- coding: utf-8 -*- 
  3   
  4   
  5  """pcap_to_object1 
  6   
  7  Generate a serialized graph object from the pcap file. 
  8   
  9  This script uses Pylibpcap which is faster than pcapy. So it is recommended to 
 10  use this script instead of using pcap_to_object.py 
 11   
 12  http://sourceforge.net/projects/pylibpcap/ 
 13   
 14  http://sourceforge.net/projects/pylibpcap/ 
 15  """ 
 16   
 17  __author__ = "Jerome Hussenet, Cedric Bonhomme" 
 18  __version__ = "$Revision: 0.1 $" 
 19  __date__ = "$Date: 2009/02/20 $" 
 20  __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme" 
 21  __license__ = "Python" 
 22   
 23  import os 
 24  import sys 
 25   
 26  import pcap 
 27  import socket 
 28  import struct 
 29   
 30  import pickle 
 31   
 32   
33 -def decode_ip_packet(s):
34 """Decode IP packets""" 35 d = {} 36 #d['version'] = (ord(s[0]) & 0xf0) >> 4 37 #d['header_len'] = ord(s[0]) & 0x0f 38 #d['tos'] = ord(s[1]) 39 #d['total_len'] = socket.ntohs(struct.unpack('H', s[2:4])[0]) 40 #d['id'] = socket.ntohs(struct.unpack('H', s[4:6])[0]) 41 #d['flags'] = (ord(s[6]) & 0xe0) >> 5 42 #d['fragment_offset'] = socket.ntohs(struct.unpack('H', s[6:8])[0] & 0x1f) 43 #d['ttl'] = ord(s[8]) 44 #d['protocol'] = ord(s[9]) 45 #d['checksum'] = socket.ntohs(struct.unpack('H', s[10:12])[0]) 46 d['source_address'] = pcap.ntoa(struct.unpack('i', s[12:16])[0]) 47 d['destination_address'] = pcap.ntoa(struct.unpack('i', s[16:20])[0]) 48 #if d['header_len'] > 5: 49 #d['options'] = s[20:4*(d['header_len']-5)] 50 #else: 51 #d['options'] = None 52 #d['data'] = s[4*d['header_len']:] 53 return d
54
55 -def pcap_to_object(pcap_file, obj_file):
56 """Create a Python serialized graph object. 57 58 Read the pcap file given in parameter, extracts source and destination IP 59 and write a serialized graph object. 60 """ 61 reader = pcap.pcapObject() 62 reader.open_offline(pcap_file) 63 64 if options.verbose: 65 print "Reading pcap file..." 66 dic_ip = {} 67 while True: 68 try: 69 (_, payload, tts) = reader.next() 70 except: 71 break 72 if payload[12:14] == '\x08\x00': 73 decoded_ip_packet = decode_ip_packet(payload[14:]) 74 if decoded_ip_packet['source_address'] not in dic_ip: 75 dic_ip[decoded_ip_packet['source_address']] = {} 76 dic_ip[decoded_ip_packet['source_address']] \ 77 [decoded_ip_packet['destination_address']] = 1 78 else: 79 if decoded_ip_packet['destination_address'] not in \ 80 dic_ip[decoded_ip_packet['source_address']]: 81 dic_ip[decoded_ip_packet['source_address']] \ 82 [decoded_ip_packet['destination_address']] = 1 83 else: 84 dic_ip[decoded_ip_packet['source_address']] \ 85 [decoded_ip_packet['destination_address']] += 1 86 87 if options.verbose: 88 print "Serialization..." 89 dic_obj = open(obj_file, "w") 90 pickle.dump(dic_ip, dic_obj) 91 dic_obj.close()
92 93 94 if __name__ == "__main__": 95 # Point of entry in execution mode. 96 from optparse import OptionParser 97 parser = OptionParser() 98 parser.add_option("-i", "--input", dest="pcap_file", 99 help="pcap file") 100 parser.add_option("-o", "--output", dest="obj_file", 101 help="Python serialized object") 102 parser.add_option("-q", "--quiet", 103 action="store_false", dest="verbose", 104 help="be vewwy quiet (I'm hunting wabbits)") 105 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap', 106 obj_file = './data/dic.pyobj', 107 verbose = True) 108 109 (options, args) = parser.parse_args() 110 111 pcap_to_object(options.pcap_file, options.obj_file) 112