Created
April 23, 2019 11:08
-
-
Save aurorapar/b5490b377baed98b2b966c8015b53257 to your computer and use it in GitHub Desktop.
Parses a network traffic file and stores into a pickled dictionary
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import dpkt | |
from socket import inet_ntoa | |
import traceback | |
import datetime | |
import multiprocessing | |
try: | |
import cPickle as pickle | |
except: | |
import pickle | |
myAddress = 'X.X.X.X' | |
dataFileName = 'alldata.dat' | |
dataFile = open(dataFileName, 'wb') | |
try: | |
dpktData = pickle.load(dataFile) | |
except IOError: | |
dpktData = {} | |
def inet_to_str(inet): | |
return socket.inet_ntop(socket.AF_INET, inet) | |
badFrames = 0 | |
data = "" | |
maxProcesses = 100 | |
pool = [] | |
jobsProcessed = 0 | |
def storeData(timestamp, buf): | |
try: | |
eth = dpkt.ethernet.Ethernet(buf) | |
if not isinstance(eth.data, dpkt.ip.IP): | |
return | |
ip = eth.data | |
info = {'source':inet_ntoa(ip.src), | |
'destination':inet_ntoa(ip.dst), | |
'payload':ip.data, | |
'type':eth.type} | |
if myAddress != info['source'] and myAddress != info['destination']: | |
return | |
try: | |
dpktData[str(datetime.datetime.utcfromtimestamp(timestamp))] = info | |
except: | |
badFrames += 1 | |
return | |
except: | |
traceback.print_exc() | |
return | |
if __name__ == '__main__': | |
with open("alldata2.pcap", 'rb') as data: | |
pcap = dpkt.pcap.Reader(data) | |
for timestamp, buf in pcap: | |
if len(pool) == maxProcesses: | |
for job in pool: | |
if not job.is_alive(): | |
pool.remove(job) | |
if len(pool) == maxProcesses: | |
pool.pop().join() | |
jobsProcessed += 1 | |
if jobsProcessed % 1000 == 0: | |
print "Jobs processed: %s"%jobsProcessed | |
spawn = multiprocessing.Process(target=storeData, args=(timestamp, buf)) | |
spawn.start() | |
pool.append(spawn) | |
pickle.dump(dpktData, dataFile) | |
dataFile.close() | |
print "%s bad frames"%badFrames | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment