def test_tcp_states(self): nc = NetworkConnection() nc.source_tcp_state = "LISTEN" nc.destination_tcp_state = "ESTABLISHED" nc2 = round_trip(nc) self.assertEqual(nc.to_dict(), nc2.to_dict())
def TCPConnectionEstablishedObj(tcpinfo): networkconnection = NetworkConnection() networkconnection.layer3_protocol = "IPv4" networkconnection.layer4_protocol = "TCP" if tcpinfo[0] != VMIP: # incoming connection networkconnection.destination_tcp_state = "ESTABLISHED" ssocketaddress = SocketAddress() ssocketaddress.ip_address = tcpinfo[0] sport = Port() sport.port_value = tcpinfo[2] sport.layer4_protocol = "TCP" ssocketaddress.port = sport networkconnection.source_socket_address = ssocketaddress elif tcpinfo[1] != VMIP: # outgoing connection networkconnection.source_tcp_state = "ESTABLISHED" dsocketaddress = SocketAddress() dsocketaddress.ip_address = tcpinfo[1] dport = Port() dport.port_value = tcpinfo[3] dport.layer4_protocol = "TCP" dsocketaddress.port = dport networkconnection.destination_socket_address = dsocketaddress indicator = Indicator() indicator.title = "TCP Connection Established" indicator.description = ( "An indicator containing information about a successful TCP hand shake" ) indicator.set_produced_time(utils.dates.now()) indicator.add_object(networkconnection) return indicator
def create_network_connection(self,creation_time=None,destination_socket_address=None,destination_tcp_state=None,source_socket_address=None,source_tcp_state=None,tls_used=None, layer7_protocol=None,layer4_protocol=None,layer3_protocol=None,layer7_connections=None): network_connection = NetworkConnection() network_connection.creation_time= DateTime(creation_time) network_connection.destination_socket_address = destination_socket_address network_connection.destination_tcp_state = destination_tcp_state network_connection.source_socket_address = source_socket_address network_connection.source_tcp_state = source_tcp_state network_connection.tls_used =tls_used network_connection.layer7_protocol= layer7_protocol network_connection.layer4_protocol =layer4_protocol network_connection.layer3_protocol = layer3_protocol network_connection.layer7_connections = layer7_connections return network_connection