def ether_decode(self, p): data = {} # 解析出的信息以dict的形式保存 if p.haslayer("Ether"): # scapy.haslayer,将pcap包中的信息分层,再处理 data = self.ip_decode(p) # 解析IP层协议 return data else: data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = '' data['dest_ip'] = '' data['protocol'] = '' data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = '' data['dest_port'] = '' return data
def udp_decode(self, p, ip): data = {} udp = p.getlayer("UDP") data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = ip.src data['dest_ip'] = ip.dst data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = str(ip.sport) data['dest_port'] = str(ip.dport) if udp.dport in self.PORT_DICT: # 若端口信息在PORT_DICT\UDP_DICT中则转换为已知 data['protocol'] = self.PORT_DICT[udp.dport] elif udp.sport in self.PORT_DICT: data['protocol'] = self.PORT_DICT[udp.sport] elif udp.dport in self.UDP_DICT: data['protocol'] = self.UDP_DICT[udp.dport] elif udp.sport in self.UDP_DICT: data['protocol'] = self.UDP_DICT[udp.sport] else: data['protocol'] = "UDP" return data
def _fix(self): return corrupt_bytes(self.s, self.p, self.n)
def ip_decode(self, p): data = {} if p.haslayer("IP"): # 2048:Internet IP (IPv4) ,分IPV4和IPV6和其他协议 ip = p.getlayer("IP") if p.haslayer("TCP"): # 6:TCP data = self.tcp_decode(p, ip) return data elif p.haslayer("UDP"): # 17:UDP data = self.udp_decode(p, ip) return data else: if ip.proto in self.IP_DICT: # 若ip分层中的协议信息在字典中,则提取ip分层中的源地址、目的地址、协议(转换)等 data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = ip.src data['dest_ip'] = ip.dst data['protocol'] = self.IP_DICT[ip.proto] data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = 'UnKnow' data['dest_port'] = 'UnKnow' return data else: data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = ip.src data['dest_ip'] = ip.dst data['protocol'] = 'IPv4' data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = 'UnKnow' data['dest_port'] = 'UnKnow' return data elif p.haslayer("IPv6"): # 34525:IPv6 ipv6 = p.getlayer("IPv6") if p.haslayer("TCP"): # 6:TCP data = self.tcp_decode(p, ipv6) return data elif p.haslayer("UDP"): # 17:UDP data = self.udp_decode(p, ipv6) return data else: if ipv6.nh in self.IP_DICT: data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = ipv6.src data['dest_ip'] = ipv6.dst data['protocol'] = self.IP_DICT[ipv6.nh] data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = 'UnKnow' data['dest_port'] = 'UnKnow' return data else: data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = ipv6.src data['dest_ip'] = ipv6.dst data['protocol'] = 'IPv6' data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = 'UnKnow' data['dest_port'] = 'UnKnow' return data else: if p.type in self.ETHER_DICT: data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = p.src data['dest_ip'] = p.dst data['protocol'] = self.ETHER_DICT[p.type] data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = 'UnKnow' data['dest_port'] = 'UnKnow' return data else: data['time'] = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(p.time)) data['source_ip'] = p.src data['dest_ip'] = p.dst data['protocol'] = hex(p.type) # 若在字典中没有改协议,则以16进制的形式显示 data['len'] = len(corrupt_bytes(p)) data['info'] = p.summary() data['source_port'] = 'UnKnow' data['dest_port'] = 'UnKnow' return data
def _fix(self): # type: () -> bytes return corrupt_bytes(self.s, self.p, self.n)