1
2
3
4
5 """pcap_to_object1
6
7 Generate a serialized graph object from the pcap file.
8
9 This script uses Pylibpcap which is faster than pcapy. So it is recommended to
10 use this script instead of using pcap_to_object.py
11
12 http://sourceforge.net/projects/pylibpcap/
13
14 http://sourceforge.net/projects/pylibpcap/
15 """
16
17 __author__ = "Jerome Hussenet, Cedric Bonhomme"
18 __version__ = "$Revision: 0.1 $"
19 __date__ = "$Date: 2009/02/20 $"
20 __copyright__ = "Copyright (c) 2009 Jerome Hussenet, Copyright (c) 2009 Cedric Bonhomme"
21 __license__ = "Python"
22
23 import os
24 import sys
25
26 import pcap
27 import socket
28 import struct
29
30 import pickle
31
32
34 """Decode IP packets"""
35 d = {}
36
37
38
39
40
41
42
43
44
45
46 d['source_address'] = pcap.ntoa(struct.unpack('i', s[12:16])[0])
47 d['destination_address'] = pcap.ntoa(struct.unpack('i', s[16:20])[0])
48
49
50
51
52
53 return d
54
56 """Create a Python serialized graph object.
57
58 Read the pcap file given in parameter, extracts source and destination IP
59 and write a serialized graph object.
60 """
61 reader = pcap.pcapObject()
62 reader.open_offline(pcap_file)
63
64 if options.verbose:
65 print "Reading pcap file..."
66 dic_ip = {}
67 while True:
68 try:
69 (_, payload, tts) = reader.next()
70 except:
71 break
72 if payload[12:14] == '\x08\x00':
73 decoded_ip_packet = decode_ip_packet(payload[14:])
74 if decoded_ip_packet['source_address'] not in dic_ip:
75 dic_ip[decoded_ip_packet['source_address']] = {}
76 dic_ip[decoded_ip_packet['source_address']] \
77 [decoded_ip_packet['destination_address']] = 1
78 else:
79 if decoded_ip_packet['destination_address'] not in \
80 dic_ip[decoded_ip_packet['source_address']]:
81 dic_ip[decoded_ip_packet['source_address']] \
82 [decoded_ip_packet['destination_address']] = 1
83 else:
84 dic_ip[decoded_ip_packet['source_address']] \
85 [decoded_ip_packet['destination_address']] += 1
86
87 if options.verbose:
88 print "Serialization..."
89 dic_obj = open(obj_file, "w")
90 pickle.dump(dic_ip, dic_obj)
91 dic_obj.close()
92
93
94 if __name__ == "__main__":
95
96 from optparse import OptionParser
97 parser = OptionParser()
98 parser.add_option("-i", "--input", dest="pcap_file",
99 help="pcap file")
100 parser.add_option("-o", "--output", dest="obj_file",
101 help="Python serialized object")
102 parser.add_option("-q", "--quiet",
103 action="store_false", dest="verbose",
104 help="be vewwy quiet (I'm hunting wabbits)")
105 parser.set_defaults(pcap_file = './captures/jubrowska-capture_1.cap',
106 obj_file = './data/dic.pyobj',
107 verbose = True)
108
109 (options, args) = parser.parse_args()
110
111 pcap_to_object(options.pcap_file, options.obj_file)
112