Script para obtener datos sobre el trafico filtrado

calcular_estadisticas.py

import pandas as pd
import subprocess
import sys
from os import path
from progress.bar import Bar

from collections import Counter
import numpy as np
import json


if len(sys.argv) < 2:
    print("Uso" + sys.argv[0] + "captura.json")
    exit()

frame_numbers = []


#Leemos los frame numbers generados por el script del pdf
handle = open("frame_numbers.cache", "r")

lines = handle.readlines()
with Bar("Cargando paquetes desde cache...", max=len(lines)) as bar:
    for line in lines:
        frame_numbers.append(line.strip())
        bar.next()

handle.close()


print("Leyendo archivo json...")
file = open(sys.argv[1],"r",encoding="utf8")

file_json = json.load(file)


frame_lens = []
ip_lens = []
tcp_lens = []

for i in file_json:
    label = i['_source']['layers']['frame']['frame.number']
    #Filtramos
    if label in frame_numbers:
        frame_lens.append(int( i['_source']['layers']['frame']['frame.len']))
        ip_lens.append( int (i['_source']['layers']['ip']['ip.len']) )
        tcp_lens.append(int(i['_source']['layers']['tcp']['tcp.len']))



#Estadisticas
np_frame = np.array(frame_lens)
np_ip = np.array(ip_lens)
np_tcp = np.array(tcp_lens)


print("Estadisticas de frame.len:")
print("Media: " + str(np_frame.mean()))
print("Desviacion estandar: " + str(np_frame.std()))

print("###")

print("Estadisticas de ip.len:")
print("Media: " + str(np_ip.mean()))
print("Desviacion estandar: " + str(np_ip.std()))

print("###")

print("Estadisticas de tcp.len:")
print("Media: " + str(np_tcp.mean()))
print("Desviacion estandar: " + str(np_tcp.std()))
print("###")



#Tipo de trafico


tipos_trafico = []


for i in file_json:
    tipos_trafico.append(i['_source']['layers']['frame']['frame.protocols'])



print("Tipos de trafico:")

for value, count in Counter(tipos_trafico).most_common():
    print(value, count)





flags_ip = []
flags_tcp = []

for i in file_json:
    if 'ip' in i['_source']['layers']:
        flags_ip.append(i['_source']['layers']['ip']['ip.flags'])
     
    if 'tcp' in i['_source']['layers']:
       flags_tcp.append(i['_source']['layers']['tcp']['tcp.flags'])




print("Flags IP:")
for value, count in Counter(flags_ip).most_common():
    print(value, count)


print("Flags TCP:")
for value, count in Counter(flags_tcp).most_common():
    print(value, count)





checksums_ip = []
checksums_tcp = []

#Checksums
for i in file_json:
    if 'ip' in i['_source']['layers']:
        checksums_ip.append(i['_source']['layers']['ip']['ip.checksum.status'])
     
    if 'tcp' in i['_source']['layers']:
       checksums_tcp.append(i['_source']['layers']['tcp']['tcp.checksum.status'])




print("Checksums IP:")
for value, count in Counter(checksums_ip).most_common():
    print(value, count)


print("Checksums TCP:")
for value, count in Counter(checksums_tcp).most_common():
    print(value, count)


#payloads


tcp_payloads = []


for i in file_json:
    if 'tcp' in i['_source']['layers']:
        if 'tcp.payload' in i['_source']['layers']['tcp']:
            tcp_payloads.append(i['_source']['layers']['tcp']['tcp.payload'])




print("Payloads TCP:")
for value, count in Counter(tcp_payloads).most_common():
    print(str(value) + " "+ str(count))