Ejemplo n.º 1
0
    def __call__(self, line):
        """Extract attributes from flow

        Parameters
        ----------
        line : string
            A line in netflow file

        """
        from util import ip2int, int2ip
        try:
            time, dur, proto, src, sport, dst, dport, flags, tos, packets, size, flows = self.pt.match(
                line).groups()
            data = {
                ## temporal atributes
                'time': self._conv_time(time),
                'duration': self._conv_duration(dur),  #microseconds
                ## spatial atributes
                'src': ip2int(src),
                'dst': ip2int(dst),
                'sport': int(float(sport)),
                'dport': int(float(dport)),
                ## other atributes
                'proto': self._conv_proto(proto),
                'flags': self._conv_flags(flags),
                'tos': int(tos),
                ## behavioral attributes
                'packets': int(packets),
                'size': self._conv_size(size),
                'flows': int(flows),
                'flow': 0
            }
            return tuple(data[f] for f in self.fields)
        except Exception as e:
            return None
Ejemplo n.º 2
0
    def __call__(self, line):
        """Extract attributes from flow

        Parameters
        ----------
        line : string
            A line in netflow file

        """
        from util import ip2int,int2ip
        try:
            time,dur,proto,src,sport,dst,dport,flags,tos,packets,size,flows = self.pt.match(line).groups()
            data = {
                ## temporal atributes
                'time': self._conv_time(time),'duration':self._conv_duration(dur), #microseconds
                ## spatial atributes
                'src': ip2int(src), 'dst':ip2int(dst),
                'sport':int(float(sport)),'dport':int(float(dport)),
                ## other atributes
                'proto':self._conv_proto(proto),'flags':self._conv_flags(flags), 'tos':int(tos),
                ## behavioral attributes
                'packets':int(packets),'size':self._conv_size(size),'flows':int(flows),
                'flow': 0
            }
            return tuple(data[f] for f in self.fields)
        except Exception as e:
            return None
Ejemplo n.º 3
0
    def __call__(self, pkt):
        """Extract attributes from packet

        Parameters
        ----------
        pkt : util.PacketWrapper
            A packet obtained by util.get_packet

        """
        from impacket.ImpactPacket import IP, TCP, UDP, ICMP, Data
        from util import ip2int, int2ip

        if (IP not in pkt) or (TCP not in pkt and UDP not in pkt):
            return None
        ip = pkt[IP]
        result = {
            'time': int(pkt.get_timestamp() * 1e6),
            'src': ip2int(ip.get_ip_src()),
            'dst': ip2int(ip.get_ip_dst()),
            'paylen': ip.get_ip_len() - 4 * ip.get_ip_hl(),
            'sport': 0,
            'dport': 0,
            'proto': ip.get_ip_p(),
            'seq': 0,
            'flags': 0,
            'flow': 0
        }

        if TCP in pkt:
            t = pkt[TCP]
            result['paylen'] -= 4 * t.get_th_off()
            result['sport'] = t.get_th_sport()
            result['dport'] = t.get_th_dport()
            result['seq'] = t.get_th_seq()
            result['flags'] = t.get_th_flags() & 0x1ff
        elif UDP in pkt:
            u = pkt[UDP]
            result['paylen'] -= 8
            result['sport'] = u.get_uh_sport()
            result['dport'] = u.get_uh_dport()
        return tuple(result[f] for f in self.fields)
Ejemplo n.º 4
0
    def __call__(self, pkt):
        """Extract attributes from packet

        Parameters
        ----------
        pkt : util.PacketWrapper
            A packet obtained by util.get_packet

        """
        from impacket.ImpactPacket import IP,TCP,UDP,ICMP,Data
        from util import ip2int,int2ip

        if (IP not in pkt) or (TCP not in pkt and UDP not in pkt):
            return None
        ip = pkt[IP]
        result = {
            'time':int(pkt.get_timestamp()*1e6),
            'src': ip2int(ip.get_ip_src()),
            'dst': ip2int(ip.get_ip_dst()),
            'paylen': ip.get_ip_len() - 4*ip.get_ip_hl(),
            'sport': 0,
            'dport': 0,
            'proto': ip.get_ip_p(),
            'seq': 0,
            'flags': 0,
            'flow': 0
        }

        if TCP in pkt:
            t = pkt[TCP]
            result['paylen'] -=  4*t.get_th_off()
            result['sport'] = t.get_th_sport()
            result['dport'] = t.get_th_dport()
            result['seq'] = t.get_th_seq()
            result['flags'] = t.get_th_flags() & 0x1ff
        elif UDP in pkt:
            u = pkt[UDP]
            result['paylen'] -=  8
            result['sport'] = u.get_uh_sport()
            result['dport'] = u.get_uh_dport()
        return tuple(result[f] for f in  self.fields)
Ejemplo n.º 5
0
 def __call__(self, p):
     from scapy.all import IPv6, IP, TCP, UDP
     from util import ip2int, int2ip
     if (IP not in p) or (TCP not in p and UDP not in p):
         return None
     ip = p[IP] if IP in p else p[IPv6]
     result = {
         'time': int(p.time * 1e6),
         'src': ip2int(ip.src),
         'dst': ip2int(ip.dst),
         'paylen': 0,
         'sport': 0,
         'dport': 0,
         'proto': 0,
         'seq': 0,
         'flags': 0,
         'flow': 0
     }
     if IP in ip:
         result['paylen'] = ip.len - 4 * ip.ihl
         result['proto'] = ip.proto
     elif IPv6 in ip:
         result['paylen'] = ip.plen
         result['proto'] = ip.nh
     if TCP in ip:
         t = ip[TCP]
         result['paylen'] -= 4 * t.dataofs
         result['sport'] = t.sport
         result['dport'] = t.dport
         result['seq'] = t.seq
         result['flags'] = t.flags
     elif UDP in ip:
         u = ip[UDP]
         result['paylen'] -= 8
         result['sport'] = u.sport
         result['dport'] = u.dport
     return tuple(result[f] for f in self.fields)
Ejemplo n.º 6
0
 def __call__(self, p):
     from scapy.all import IPv6,IP,TCP,UDP
     from util import ip2int,int2ip
     if (IP not in p) or (TCP not in p and UDP not in p):
         return None
     ip = p[IP] if IP in p else p[IPv6]
     result = {
         'time':int(p.time*1e6),
         'src': ip2int(ip.src),
         'dst': ip2int(ip.dst),
         'paylen': 0,
         'sport': 0,
         'dport': 0,
         'proto': 0,
         'seq': 0,
         'flags': 0,
         'flow': 0
     }
     if IP in ip:
         result['paylen'] = ip.len - 4*ip.ihl
         result['proto'] = ip.proto
     elif IPv6 in ip:
         result['paylen'] = ip.plen
         result['proto'] = ip.nh
     if TCP in ip:
         t = ip[TCP]
         result['paylen'] -=  4*t.dataofs
         result['sport'] = t.sport
         result['dport'] = t.dport
         result['seq'] = t.seq
         result['flags'] = t.flags
     elif UDP in ip:
         u = ip[UDP]
         result['paylen'] -=  8
         result['sport'] = u.sport
         result['dport'] = u.dport
     return tuple(result[f] for f in  self.fields)