def main():
follower = TCPStreamFollower(data_callback)
s = BlockingSniffer("en0", read_timeout=5000, snapshot_length=65000)
s.filter = "tcp and port 3128"
with s.iterator(lambda p: EthernetII(buf=p), -1) as i:
list_of_pdu = (pdu for _, _, _, pdu in i)
follower.feed(list_of_pdu)
def callbackHTTP(self, sec, usec, caplen, length, mview):
ethernet_pdu = self.assembler.feed(EthernetII.from_buffer(mview))
if ethernet_pdu is not None:
ip = ethernet_pdu.rfind_pdu(IP)
if ip is not None:
#print(ip.src_addr, ip.dst_addr)
raw = ip.rfind_pdu(RAW)
if raw:
#print ("total", raw.size)
if raw.size < 10:
#print('payload', type(ip.ref_inner_pdu()), raw.payload)
pass
def callbackHTTP(self, sec, usec, caplen, length, mview):
ethernet_pdu = self.assembler.feed(EthernetII.from_buffer(mview))
if ethernet_pdu is not None:
ip = ethernet_pdu.rfind_pdu(IP)
if ip is not None:
#print(ip.src_addr, ip.dst_addr)
raw = ip.rfind_pdu(RAW)
if raw:
#print ("total", raw.size)
if raw.size < 10:
#print('payload', type(ip.ref_inner_pdu()), raw.payload)
pass
def callbackDNS(self, sec, usec, caplen, mview):
print('DNS caplen: %s %s' % (caplen, len(mview)))
ethernet_pdu = EthernetII.from_buffer(mview)
ip = ethernet_pdu.rfind_pdu(IP)
print("IP is None?", ip is None)
if ip is not None:
print('IP from %s to %s' % (ip.src_addr, ip.dst_addr))
raw = ethernet_pdu.rfind_pdu(RAW)
if raw is not None:
dns = raw.to(DNS)
if dns is not None:
print("Queries from %s to %s, %s questions, %s answers" % (
str(ip.src_addr), str(ip.dst_addr), dns.queries_count(), dns.answers_count()
))
print([(query.name, query.query_type, query.query_class) for query in dns.get_queries()])
def callbackDNS(self, sec, usec, caplen, mview):
print('DNS caplen: %s %s' % (caplen, len(mview)))
ethernet_pdu = EthernetII.from_buffer(mview)
ip = ethernet_pdu.rfind_pdu(IP)
print("IP is None?", ip is None)
if ip is not None:
print('IP from %s to %s' % (ip.src_addr, ip.dst_addr))
raw = ethernet_pdu.rfind_pdu(RAW)
if raw is not None:
dns = raw.to(DNS)
if dns is not None:
print("Queries from %s to %s, %s questions, %s answers" %
(str(ip.src_addr), str(ip.dst_addr),
dns.queries_count(), dns.answers_count()))
print([(query.name, query.query_type, query.query_class)
for query in dns.get_queries()])