Skip to content

Instantly share code, notes, and snippets.

@aurorapar
Created April 23, 2019 11:08
Show Gist options
  • Save aurorapar/b5490b377baed98b2b966c8015b53257 to your computer and use it in GitHub Desktop.
Save aurorapar/b5490b377baed98b2b966c8015b53257 to your computer and use it in GitHub Desktop.
Parses a network traffic file and stores into a pickled dictionary
import dpkt
from socket import inet_ntoa
import traceback
import datetime
import multiprocessing
try:
import cPickle as pickle
except:
import pickle
myAddress = 'X.X.X.X'
dataFileName = 'alldata.dat'
dataFile = open(dataFileName, 'wb')
try:
dpktData = pickle.load(dataFile)
except IOError:
dpktData = {}
def inet_to_str(inet):
return socket.inet_ntop(socket.AF_INET, inet)
badFrames = 0
data = ""
maxProcesses = 100
pool = []
jobsProcessed = 0
def storeData(timestamp, buf):
try:
eth = dpkt.ethernet.Ethernet(buf)
if not isinstance(eth.data, dpkt.ip.IP):
return
ip = eth.data
info = {'source':inet_ntoa(ip.src),
'destination':inet_ntoa(ip.dst),
'payload':ip.data,
'type':eth.type}
if myAddress != info['source'] and myAddress != info['destination']:
return
try:
dpktData[str(datetime.datetime.utcfromtimestamp(timestamp))] = info
except:
badFrames += 1
return
except:
traceback.print_exc()
return
if __name__ == '__main__':
with open("alldata2.pcap", 'rb') as data:
pcap = dpkt.pcap.Reader(data)
for timestamp, buf in pcap:
if len(pool) == maxProcesses:
for job in pool:
if not job.is_alive():
pool.remove(job)
if len(pool) == maxProcesses:
pool.pop().join()
jobsProcessed += 1
if jobsProcessed % 1000 == 0:
print "Jobs processed: %s"%jobsProcessed
spawn = multiprocessing.Process(target=storeData, args=(timestamp, buf))
spawn.start()
pool.append(spawn)
pickle.dump(dpktData, dataFile)
dataFile.close()
print "%s bad frames"%badFrames
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment