Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Analyzing pcap files using dpkt with python #49

Open
rabbitoc opened this issue Jan 19, 2020 · 0 comments
Open

Analyzing pcap files using dpkt with python #49

rabbitoc opened this issue Jan 19, 2020 · 0 comments

Comments

@rabbitoc
Copy link

please i am trying to analyse a pcap file in python using dpkt. I am having troubles with the code that 1) counts the number of TCP flows in the pcap file 2) counts the number of UDP flows in the pcap file 3) counts the number of unique IP addresses 4) calculate the total number of packets per flow 5) calculate the average packet size per flow 6) calculate the duration of each flow. From my code above, i have not been able to achieve that.
I will appreciate it if anyone can help me with the python code for the above question. Thanks

this is what i have done so far

import dpkt
from functools import reduce
import socket

flows = {}

for ts,pkt in dpkt.pcap.Reader(open('tesst.pcap','rb')):
eth=dpkt.ethernet.Ethernet(pkt)

if eth.type==dpkt.ethernet.ETH_TYPE_IP:

    ip=eth.data

    if ip.p==dpkt.ip.IP_PROTO_TCP:

        tcp = ip.data
        src_ip = socket.inet_ntoa(ip.src)
        src_port = tcp.sport
        dst_ip = socket.inet_ntoa(ip.dst)
        dst_port = tcp.dport

        flow = sorted([(src_ip, src_port), (dst_ip, dst_port)])
        flow = (flow[0], flow[1])
        # uncomment below for uni-directional flow
        # flow = (src_ip, src_port, dst_ip, dst_port)


        flow_data = {
            'byte_count': len(eth)
        }

        if flows.get(flow):
            flows[flow].append(flow_data)
        else:
            flows[flow] = [flow_data]

for k in flows.keys():
print(f'Data for flow: {k}:')
bytes = reduce(lambda x, y: x+y,
map(lambda e: e['byte_count'], flows[k]))
print(f"Total Bytes: {bytes}")

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant