def test():
"""Test for Flows class"""
import pprint
# Local imports
from chains.sources import packet_streamer
from chains.links import packet_meta, reverse_dns, transport_meta
# Create a PacketStreamer, a PacketMeta, and link them to TransportMeta
data_path = file_utils.relative_dir(__file__, '../../data/http.pcap')
streamer = packet_streamer.PacketStreamer(iface_name=data_path,
max_packets=1000)
meta = packet_meta.PacketMeta()
rdns = reverse_dns.ReverseDNS()
tmeta = transport_meta.TransportMeta()
flows = Flows()
# Set up chain
meta.link(streamer)
rdns.link(meta)
tmeta.link(rdns)
flows.link(tmeta)
# Print out the flow information
for flow in flows.output_stream:
print_flow_info(flow)
def test():
"""Test for the Flow class"""
# Local imports
from chains.sources import packet_streamer
from chains.links import packet_meta, reverse_dns, transport_meta
# Create a PacketStreamer, a PacketMeta, and link them to TransportMeta
data_path = file_utils.relative_dir(__file__, '../../data/http.pcap')
streamer = packet_streamer.PacketStreamer(iface_name=data_path,
max_packets=100)
meta = packet_meta.PacketMeta()
rdns = reverse_dns.ReverseDNS()
tmeta = transport_meta.TransportMeta()
# Set up chain
meta.link(streamer)
rdns.link(meta)
tmeta.link(rdns)
# Put the packets into flows
flows = defaultdict(Flow)
for packet in tmeta.output_stream:
flow_id = flow_tuple(packet)
flows[flow_id].add_packet(packet)
# Print out flow information
for flow in flows.values():
fd = flow.get_flow()
print('Flow %s -- Packets:%d Bytes:%d Payload: %s' %
(fd['flow_id'], len(fd['packet_list']), len(
fd['payload']), repr(fd['payload'])[:20]))
def test():
"""Test for DNSMeta class"""
import pprint
# Local imports
from chains.sources import packet_streamer
from chains.links import packet_meta, reverse_dns, transport_meta
# Create a PacketStreamer, a PacketMeta, and link them to DNSMeta
data_path = file_utils.relative_dir(__file__, '../../data/dns.pcap')
streamer = packet_streamer.PacketStreamer(iface_name=data_path,
max_packets=10000)
meta = packet_meta.PacketMeta()
rdns = reverse_dns.ReverseDNS()
tmeta = transport_meta.TransportMeta()
dns_meta = DNSMeta()
# Set up chain
meta.link(streamer)
rdns.link(meta)
tmeta.link(rdns)
dns_meta.link(tmeta)
# Print out the DNS meta data
for item in dns_meta.output_stream:
if 'dns' in item:
print()
pprint.pprint(item['dns'])
else:
print('.', end='')
def test():
"""Test for HTTPMeta class"""
# Local imports
from chains.sources import packet_streamer
from chains.links import packet_meta, reverse_dns, transport_meta, flows
# Create a PacketStreamer, a PacketMeta, and link them to HTTPMeta
data_path = file_utils.relative_dir(__file__, '../../data/http.pcap')
streamer = packet_streamer.PacketStreamer(iface_name=data_path,
max_packets=10000)
meta = packet_meta.PacketMeta()
rdns = reverse_dns.ReverseDNS()
tmeta = transport_meta.TransportMeta()
fmeta = flows.Flows()
http_meta = HTTPMeta()
# Set up chain
meta.link(streamer)
rdns.link(meta)
tmeta.link(rdns)
fmeta.link(tmeta)
http_meta.link(fmeta)
# Print out the tags
for item in http_meta.output_stream:
if item['http']:
print('%s %s --> %s %s' % (item['http']['type'], item['src'],
item['dst'], item['http']['data']))
def run(iface_name=None, bpf=None, summary=None, max_packets=50):
"""Run the Simple Packet Printer Example"""
# Create the classes
streamer = packet_streamer.PacketStreamer(iface_name=iface_name, bpf=bpf, max_packets=max_packets)
meta = packet_meta.PacketMeta()
rdns = reverse_dns.ReverseDNS()
tags = packet_tags.PacketTags()
tmeta = transport_meta.TransportMeta()
printer = packet_summary.PacketSummary()
# Set up the chain
meta.link(streamer)
rdns.link(meta)
tags.link(rdns)
tmeta.link(tags)
printer.link(tmeta)
# Pull the chain
printer.pull()
def test():
"""Test for TLSMeta class"""
# Local imports
from chains.sources import packet_streamer
from chains.links import packet_meta, reverse_dns, transport_meta, flows
# Create a PacketStreamer, a PacketMeta, and link them to TLSMeta
data_path = file_utils.relative_dir(__file__, '../../data/https.pcap')
streamer = packet_streamer.PacketStreamer(iface_name=data_path,
max_packets=10000)
meta = packet_meta.PacketMeta()
rdns = reverse_dns.ReverseDNS()
tmeta = transport_meta.TransportMeta()
fmeta = flows.Flows()
tls_meta = TLSMeta()
# Set up chain
meta.link(streamer)
rdns.link(meta)
tmeta.link(rdns)
fmeta.link(tmeta)
tls_meta.link(fmeta)
# Print out the tags
for item in tls_meta.output_stream:
if item['tls']:
tls_records = item['tls']['data']['tls_records']
if item['tls']['type'] == 'TLS_CTS':
print('HTTPS_REQUEST')
print('\t%s --> %s (%s) tls_records(%d)\n' %
(item['src'], item['dst'], item['dst_domain'],
len(tls_records)))
else:
print('HTTPS_RESPONSE')
print('\t%s (%s) --> %s tls_records(%d)\n' %
(item['src'], item['src_domain'], item['dst'],
len(tls_records)))
else:
logger.info('Could not find TLS in Flow:')
flows.print_flow_info(item)