pax_global_header00006660000000000000000000000064133574430300014514gustar00rootroot0000000000000052 comment=67520cfbb6c2e9ab3e7c181a8012ddc56ec5cad8 pypcapfile-master/000077500000000000000000000000001335744303000145055ustar00rootroot00000000000000pypcapfile-master/.gitignore000066400000000000000000000001101335744303000164650ustar00rootroot00000000000000#likely to be here as test fodder *.py[cod] *.pcap MANIFEST build dist pypcapfile-master/.travis.yml000066400000000000000000000002771335744303000166240ustar00rootroot00000000000000sudo: false language: python python: - 2.7 - 3.4 - 3.5 - 3.6 - pypy install: - pip install . - pip install codecov script: coverage run -m pcapfile.test after_success: codecov pypcapfile-master/AUTHORS000066400000000000000000000020501335744303000155520ustar00rootroot00000000000000- Kyle Isom (https://github.com/kisom/) - original author - Joshua Chia (https://github.com/kisom/jchia/) - load savefile from a Python File object - Christian Wenk (https://github.com/chrwen-omicron) - improve handling of different endianness - added support for nanosecond time resolution - Douglas Kastle (https://github.com/douglaskastle) - Added initial python3 support - Joss Gray (https://github.com/jossgray) - UDP transport support - Tommy Olofsson (https://github.com/tommyolofsson) - added support for large captures - Marco 'don' Kaulea (https://github.com/Don42) - fixed error in setup.py - rename misnamed variable - introduce custom exceptions - Cristian Klein (https://github.com/cristiklein) - Initial IP options support - TCP transport support - Kivanc Cakmak (https://github.com/kivanccakmak) - added Wi-Fi support - Shea Lutton (https://github.com/shealutton) - added length of pcap file - added documentation to iterate over all packets pypcapfile-master/CONTRIBUTING000066400000000000000000000012531335744303000163400ustar00rootroot00000000000000CONTRIBUTION GUIDELINES Here's a few simple requests I have for code contributions: * Please ensure all tests pass (pull requests are sent to [travis-ci](https://travis-ci.org/kisom/pypcapfile). * Please update any comments in modified functions, and update the READMEs. I will regenerate the Github page based on the changed README. * Please run the code through the `pep8` style checker and ensure all new code is compliant. * Please run the code through the `pylint` code checker; the code base strives for scores > 9.0/10.0; if there is a good reason for a lower score, please note that in the pull request. * Add your name and info to the AUTHORs file (if you want). Thanks! pypcapfile-master/LICENSE000066400000000000000000000013511335744303000155120ustar00rootroot00000000000000Copyright (c) 2013 Kyle Isom Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. pypcapfile-master/MANIFEST.in000066400000000000000000000001701335744303000162410ustar00rootroot00000000000000include *.py include setup.py include LICENSE recursive-include pcapfile *.py recursive-include pcapfile/protocols *.py pypcapfile-master/README.rst000066400000000000000000000125061335744303000162000ustar00rootroot00000000000000pypcapfile ========== .. image:: https://travis-ci.org/kisom/pypcapfile.svg :target: https://travis-ci.org/kisom/pypcapfile .. image:: https://img.shields.io/pypi/v/pypcapfile.svg :target: https://pypi.python.org/pypi/pypcapfile .. image:: https://img.shields.io/pypi/pyversions/pypcapfile.svg :target: https://pypi.python.org/pypi/pypcapfile pypcapfile is a pure Python library for handling libpcap savefiles. Installing ---------- | The easiest way to install is from | `pypi `__: .. code:: bash sudo pip install pypcapfile | Note that for pip, the package name is ``pypcapfile``; in your code you will need to | import ``pcapfile``. | Alternatively, you can install from source. Clone the repository, and run setup.py with | an install argument: .. code:: bash git clone git://github.com/kisom/pypcapfile.git cd pypcapfile ./setup.py install | This does require the Python `distutils `__ to be | installed. Introduction ------------ The core functionality is implemented in ``pcapfile.savefile``: .. code:: python >>> from pcapfile import savefile >>> testcap = open('test.pcap', 'rb') >>> capfile = savefile.load_savefile(testcap, verbose=True) [+] attempting to load test.pcap [+] found valid header [+] loaded 11 packets [+] finished loading savefile. >>> print(capfile) little-endian capture file version 2.4 microsecond time resolution snapshot length: 65535 linklayer type: LINKTYPE_ETHERNET number of packets: 11 You can take a look at the packets in ``capfile.packets``: .. code:: python >>> pkt = capfile.packets[0] >>> pkt.raw() >>> pkt.timestamp 1343676707L | Right now there is very basic support for Ethernet and Wi-Fi frames and IPv4 packet | parsing. Automatically decoding layers ----------------------------- | The ``layers`` argument to ``load_savefile`` determines how many layers to | decode; the default value of 0 does no decoding, 1 will load only the link | layer, etc... For example, with no decoding: .. code:: python >>> from pcapfile import savefile >>> from pcapfile.protocols.linklayer import ethernet >>> from pcapfile.protocols.linklayer import wifi >>> from pcapfile.protocols.network import ip >>> testcap = open('samples/test.pcap', 'rb') >>> capfile = savefile.load_savefile(testcap, verbose=True) [+] attempting to load samples/test.pcap [+] found valid header [+] loaded 3 packets [+] finished loading savefile. >>> eth_frame = ethernet.Ethernet(capfile.packets[0].raw()) >>> wifi_frame = wifi.WIFI(capfile.packets[1].raw()) >>> print(eth_frame) ethernet from 00:11:22:33:44:55 to ff:ee:dd:cc:bb:aa type IPv4 >>> print(wifi_frame) QoS data (sa: None, ta: 00:11:22:33:44:55, ra: ff:ee:dd:cc:bb:aa, da: None) >>> ip_packet = ip.IP(eth_frame.payload) >>> print(ip_packet) ipv4 packet from 192.168.2.47 to 173.194.37.82 carrying 44 bytes >>> ip_packet = ip.IP(wifi_frame.payload[0]['payload']) #if wifi_frame.category == 2 and wifi_frame.subtype == 8 >>> print(ip_packet) ipv4 packet from 192.168.2.175 to 239.255.255.250 carrying 336 bytes and this example: .. code:: python >>> from pcapfile import savefile >>> testcap = open('samples/test.pcap', 'rb') >>> capfile = savefile.load_savefile(testcap, layers=1, verbose=True) [+] attempting to load samples/test.pcap [+] found valid header [+] loaded 3 packets [+] finished loading savefile. >>> print(capfile.packets[0].packet.src) 00:11:22:33:44:55 >>> print(capfile.packets[0].packet.payload) and this example to pull the raw payload from every packet in a pcap file: .. code:: python >>> from pcapfile import savefile >>> import binascii >>> capfile = savefile.load_savefile(testcap) >>> file_length = capfile.__length__() >>> for packet in range(0, file_length): >>> pkt = capfile.packets[packet] >>> data = binascii.b2a_qp(pkt.raw()) # Do something here and lastly: .. code:: python >>> from pcapfile import savefile >>> testcap = open('samples/test.pcap', 'rb') >>> capfile = savefile.load_savefile(testcap, layers=2, verbose=True) >>> print(capfile.packets[0].packet.payload) ipv4 packet from 192.168.2.47 to 173.194.37.82 carrying 44 bytes | The IPv4 module (``ip``) currently only supports basic IP headers, i.e. it | doesn't yet parse options or add in padding. The interface is still a bit messy. Run Unit Tests -------------- * ``cd /path/pypcapfile`` * ``cp pcapfile/test/__main__.py .`` * ``python __main__.py`` Future planned improvements --------------------------- - IP options parsing (END and NOP is supported) - IPv6 support - TCP options parsing - ARP support TODO ---- #. write unit tests #. add ``__repr__`` method that shows all of the values of the fields in IP packets and Ethernet frames. See also -------- - The project's `PyPi page `__. - The project's `Sphinx `__ `documentation on PyPI `__ - The `libpcap homepage `__ Contributors ------------ A list of the project's contributors may be found in the AUTHORS file. pypcapfile-master/doc/000077500000000000000000000000001335744303000152525ustar00rootroot00000000000000pypcapfile-master/doc/Makefile000066400000000000000000000127251335744303000167210ustar00rootroot00000000000000# Makefile for Sphinx documentation # # You can set these variables from the command line. SPHINXOPTS = SPHINXBUILD = sphinx-build PAPER = BUILDDIR = build # Internal variables. PAPEROPT_a4 = -D latex_paper_size=a4 PAPEROPT_letter = -D latex_paper_size=letter ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source # the i18n builder cannot share the environment and doctrees with the others I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source .PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext help: @echo "Please use \`make ' where is one of" @echo " html to make standalone HTML files" @echo " dirhtml to make HTML files named index.html in directories" @echo " singlehtml to make a single large HTML file" @echo " pickle to make pickle files" @echo " json to make JSON files" @echo " htmlhelp to make HTML files and a HTML help project" @echo " qthelp to make HTML files and a qthelp project" @echo " devhelp to make HTML files and a Devhelp project" @echo " epub to make an epub" @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter" @echo " latexpdf to make LaTeX files and run them through pdflatex" @echo " text to make text files" @echo " man to make manual pages" @echo " texinfo to make Texinfo files" @echo " info to make Texinfo files and run them through makeinfo" @echo " gettext to make PO message catalogs" @echo " changes to make an overview of all changed/added/deprecated items" @echo " linkcheck to check all external links for integrity" @echo " doctest to run all doctests embedded in the documentation (if enabled)" clean: -rm -rf $(BUILDDIR)/* html: $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." dirhtml: $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml." singlehtml: $(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml @echo @echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml." pickle: $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle @echo @echo "Build finished; now you can process the pickle files." json: $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json @echo @echo "Build finished; now you can process the JSON files." htmlhelp: $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp @echo @echo "Build finished; now you can run HTML Help Workshop with the" \ ".hhp project file in $(BUILDDIR)/htmlhelp." qthelp: $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp @echo @echo "Build finished; now you can run "qcollectiongenerator" with the" \ ".qhcp project file in $(BUILDDIR)/qthelp, like this:" @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/pypcapfile.qhcp" @echo "To view the help file:" @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/pypcapfile.qhc" devhelp: $(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp @echo @echo "Build finished." @echo "To view the help file:" @echo "# mkdir -p $$HOME/.local/share/devhelp/pypcapfile" @echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/pypcapfile" @echo "# devhelp" epub: $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub @echo @echo "Build finished. The epub file is in $(BUILDDIR)/epub." latex: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex." @echo "Run \`make' in that directory to run these through (pdf)latex" \ "(use \`make latexpdf' here to do that automatically)." latexpdf: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo "Running LaTeX files through pdflatex..." $(MAKE) -C $(BUILDDIR)/latex all-pdf @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." text: $(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text @echo @echo "Build finished. The text files are in $(BUILDDIR)/text." man: $(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man @echo @echo "Build finished. The manual pages are in $(BUILDDIR)/man." texinfo: $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo @echo @echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo." @echo "Run \`make' in that directory to run these through makeinfo" \ "(use \`make info' here to do that automatically)." info: $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo @echo "Running Texinfo files through makeinfo..." make -C $(BUILDDIR)/texinfo info @echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo." gettext: $(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale @echo @echo "Build finished. The message catalogs are in $(BUILDDIR)/locale." changes: $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes @echo @echo "The overview file is in $(BUILDDIR)/changes." linkcheck: $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck @echo @echo "Link check complete; look for any errors in the above output " \ "or in $(BUILDDIR)/linkcheck/output.txt." doctest: $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest @echo "Testing of doctests in the sources finished, look at the " \ "results in $(BUILDDIR)/doctest/output.txt." pypcapfile-master/doc/source/000077500000000000000000000000001335744303000165525ustar00rootroot00000000000000pypcapfile-master/doc/source/conf.py000066400000000000000000000220241335744303000200510ustar00rootroot00000000000000# -*- coding: utf-8 -*- # # pypcapfile documentation build configuration file, created by # sphinx-quickstart on Mon Jul 30 19:15:53 2012. # # This file is execfile()d with the current directory set to its containing dir. # # Note that not all possible configuration values are present in this # autogenerated file. # # All configuration values have a default; values that are commented out # serve to show the default. import sys, os # If extensions (or modules to document with autodoc) are in another directory, # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here. #sys.path.insert(0, os.path.abspath('.')) # -- General configuration ----------------------------------------------------- # If your documentation needs a minimal Sphinx version, state it here. #needs_sphinx = '1.0' # Add any Sphinx extension module names here, as strings. They can be extensions # coming with Sphinx (named 'sphinx.ext.*') or your custom ones. extensions = ['sphinx.ext.autodoc', 'sphinx.ext.doctest', 'sphinx.ext.intersphinx', 'sphinx.ext.todo', 'sphinx.ext.coverage', 'sphinx.ext.imgmath'] # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] # The suffix of source filenames. source_suffix = '.rst' # The encoding of source files. #source_encoding = 'utf-8-sig' # The master toctree document. master_doc = 'index' # General information about the project. project = u'pypcapfile' copyright = u'2012, Kyle Isom' # The version info for the project you're documenting, acts as replacement for # |version| and |release|, also used in various other places throughout the # built documents. # # The short X.Y version. version = '1.0' # The full version, including alpha/beta/rc tags. release = '1.0' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. #language = None # There are two options for replacing |today|: either, you set today to some # non-false value, then it is used: #today = '' # Else, today_fmt is used as the format for a strftime call. #today_fmt = '%B %d, %Y' # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. exclude_patterns = [] # The reST default role (used for this markup: `text`) to use for all documents. #default_role = None # If true, '()' will be appended to :func: etc. cross-reference text. #add_function_parentheses = True # If true, the current module name will be prepended to all description # unit titles (such as .. function::). #add_module_names = True # If true, sectionauthor and moduleauthor directives will be shown in the # output. They are ignored by default. #show_authors = False # The name of the Pygments (syntax highlighting) style to use. pygments_style = 'sphinx' # A list of ignored prefixes for module index sorting. #modindex_common_prefix = [] # -- Options for HTML output --------------------------------------------------- # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. html_theme = 'default' # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. #html_theme_options = {} # Add any paths that contain custom themes here, relative to this directory. #html_theme_path = [] # The name for this set of Sphinx documents. If None, it defaults to # " v documentation". #html_title = None # A shorter title for the navigation bar. Default is the same as html_title. #html_short_title = None # The name of an image file (relative to this directory) to place at the top # of the sidebar. #html_logo = None # The name of an image file (within the static path) to use as favicon of the # docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 # pixels large. #html_favicon = None # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". html_static_path = ['_static'] # If not '', a 'Last updated on:' timestamp is inserted at every page bottom, # using the given strftime format. #html_last_updated_fmt = '%b %d, %Y' # If true, SmartyPants will be used to convert quotes and dashes to # typographically correct entities. #html_use_smartypants = True # Custom sidebar templates, maps document names to template names. #html_sidebars = {} # Additional templates that should be rendered to pages, maps page names to # template names. #html_additional_pages = {} # If false, no module index is generated. #html_domain_indices = True # If false, no index is generated. #html_use_index = True # If true, the index is split into individual pages for each letter. #html_split_index = False # If true, links to the reST sources are added to the pages. #html_show_sourcelink = True # If true, "Created using Sphinx" is shown in the HTML footer. Default is True. #html_show_sphinx = True # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. #html_show_copyright = True # If true, an OpenSearch description file will be output, and all pages will # contain a tag referring to it. The value of this option must be the # base URL from which the finished HTML is served. #html_use_opensearch = '' # This is the file name suffix for HTML files (e.g. ".xhtml"). #html_file_suffix = None # Output file base name for HTML help builder. htmlhelp_basename = 'pypcapfiledoc' # -- Options for LaTeX output -------------------------------------------------- latex_elements = { # The paper size ('letterpaper' or 'a4paper'). #'papersize': 'letterpaper', # The font size ('10pt', '11pt' or '12pt'). #'pointsize': '10pt', # Additional stuff for the LaTeX preamble. #'preamble': '', } # Grouping the document tree into LaTeX files. List of tuples # (source start file, target name, title, author, documentclass [howto/manual]). latex_documents = [ ('index', 'pypcapfile.tex', u'pypcapfile Documentation', u'Kyle Isom', 'manual'), ] # The name of an image file (relative to this directory) to place at the top of # the title page. #latex_logo = None # For "manual" documents, if this is true, then toplevel headings are parts, # not chapters. #latex_use_parts = False # If true, show page references after internal links. #latex_show_pagerefs = False # If true, show URL addresses after external links. #latex_show_urls = False # Documents to append as an appendix to all manuals. #latex_appendices = [] # If false, no module index is generated. #latex_domain_indices = True # -- Options for manual page output -------------------------------------------- # One entry per manual page. List of tuples # (source start file, name, description, authors, manual section). man_pages = [ ('index', 'pypcapfile', u'pypcapfile Documentation', [u'Kyle Isom'], 1) ] # If true, show URL addresses after external links. #man_show_urls = False # -- Options for Texinfo output ------------------------------------------------ # Grouping the document tree into Texinfo files. List of tuples # (source start file, target name, title, author, # dir menu entry, description, category) texinfo_documents = [ ('index', 'pypcapfile', u'pypcapfile Documentation', u'Kyle Isom', 'pypcapfile', 'One line description of project.', 'Miscellaneous'), ] # Documents to append as an appendix to all manuals. #texinfo_appendices = [] # If false, no module index is generated. #texinfo_domain_indices = True # How to display URL addresses: 'footnote', 'no', or 'inline'. #texinfo_show_urls = 'footnote' # -- Options for Epub output --------------------------------------------------- # Bibliographic Dublin Core info. epub_title = u'pypcapfile' epub_author = u'Kyle Isom' epub_publisher = u'Kyle Isom' epub_copyright = u'2012, Kyle Isom' # The language of the text. It defaults to the language option # or en if the language is not set. #epub_language = '' # The scheme of the identifier. Typical schemes are ISBN or URL. #epub_scheme = '' # The unique identifier of the text. This can be a ISBN number # or the project homepage. #epub_identifier = '' # A unique identification for the text. #epub_uid = '' # A tuple containing the cover image and cover page html template filenames. #epub_cover = () # HTML files that should be inserted before the pages created by sphinx. # The format is a list of tuples containing the path and title. #epub_pre_files = [] # HTML files shat should be inserted after the pages created by sphinx. # The format is a list of tuples containing the path and title. #epub_post_files = [] # A list of files that should not be packed into the epub file. #epub_exclude_files = [] # The depth of the table of contents in toc.ncx. #epub_tocdepth = 3 # Allow duplicate toc entries. #epub_tocdup = True # Example configuration for intersphinx: refer to the Python standard library. intersphinx_mapping = {'http://docs.python.org/': None} pypcapfile-master/doc/source/index.rst000066400000000000000000000007121335744303000204130ustar00rootroot00000000000000.. pypcapfile documentation master file, created by sphinx-quickstart on Mon Jul 30 19:15:53 2012. You can adapt this file completely to your liking, but it should at least contain the root `toctree` directive. Welcome to pypcapfile's documentation! ====================================== Contents: .. toctree:: :maxdepth: 2 intro installing Indices and tables ================== * :ref:`genindex` * :ref:`modindex` * :ref:`search` pypcapfile-master/doc/source/installing.rst000066400000000000000000000010771335744303000214550ustar00rootroot00000000000000Installing pycapfile ==================== There are two choices for installing pycapfile: * from `PyPI `_ * from source Installing from PyPI -------------------- pycapfile may be installed with easy_install or pip:: $ sudo pip install pypcapfile Installing from Source ---------------------- The source may be downloaded from the project's `Github Page `_. It uses the standard Python distutil package; run the included setup.py file with the "install" argument:: $ python setup.py install pypcapfile-master/doc/source/intro.rst000066400000000000000000000016421335744303000204420ustar00rootroot00000000000000============ Introduction ============ `pypcapfile `_ is a pure-Python library for reading and parsing packets from a `libpcap `_ savefile. The core functionality is implemented in pcapfile.savefile: :: >>> from pcapfile import savefile >>> testcap = open('test.cap', 'rb') >>> sf = savefile.load_savefile(testcap, verbose=True) [+] attempting to load test.pcap [+] found valid header [+] loaded 11 packets [+] finished loading savefile. >>> print(sf) big-endian capture file version 2.4 snapshot length: 65535 linklayer type: LINKTYPE_ETHERNET number of packets: 11 You can have a look at the packets in sf.packets: :: >>> pkt = sf.packets[0] >>> pkt.raw() >>> pkt.timestamp 1343676707L In the future, pypcapfile will support more enhancements, such as protocol parsing. pypcapfile-master/pcapfile/000077500000000000000000000000001335744303000162705ustar00rootroot00000000000000pypcapfile-master/pcapfile/__init__.py000066400000000000000000000002361335744303000204020ustar00rootroot00000000000000 class Error(Exception): pass class InvalidEncoding(Error): pass class UnknownMagicNumber(Error): pass class InvalidHeader(Error): pass pypcapfile-master/pcapfile/linklayer.py000066400000000000000000000037231335744303000206410ustar00rootroot00000000000000# contains definitions of link layer types from libpcap """ Link layer definitions and lookup functions based on libpcap's LLTYPE_* values. """ import imp import sys import pcapfile.protocols.linklayer.ethernet as ethernet import pcapfile.protocols.linklayer.wifi as wifi __LL_TYPES__ = [('LINKTYPE_NULL', 0, 'null', None), ('LINKTYPE_ETHERNET', 1, 'ethernet', ethernet.Ethernet), ('LINKTYPE_IEEE802_11_RADIOTAP', 127, wifi.Wifi), ('LINKTYPE_TOKEN_RING', 6, 'token ring', None), ('LINKTYPE_ARCNET', 7, 'ARCnet', None), ('LINKTYPE_SLIP', 8, 'SLIP', None)] def __get_ll_type__(ll_type): """ Given an lltype value, retrieve its definition. """ res = [llt for llt in __LL_TYPES__ if llt[1] == ll_type] assert len(res) < 2, 'Duplicate linklayer types.' if res: return res[0] else: return None def lookup(ll_type): """ Given an ll_type, retrieve the appropriate LL_TYPE. """ res = __get_ll_type__(ll_type) if res: return res[0] else: return res def slookup(ll_type): """ Given an ll_type, retrieve the short name for the link layer. """ res = __get_ll_type__(ll_type) if res: return res[2] else: return res def clookup(ll_type): """ Given an ll_type, retrieve the linklayer constructor to decode the packets. """ res = __get_ll_type__(ll_type) if res: return res[3] else: return res def __load_linktype__(link_type): """ Given a string for a given module, attempt to load it. """ try: filep, pathname, description = imp.find_module(link_type, sys.path) link_type_module = imp.load_module(link_type, filep, pathname, description) except ImportError: return None finally: if filep: filep.close() return link_type_module pypcapfile-master/pcapfile/protocols/000077500000000000000000000000001335744303000203145ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/__init__.py000066400000000000000000000000001335744303000224130ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/linklayer/000077500000000000000000000000001335744303000223065ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/linklayer/__init__.py000066400000000000000000000000001335744303000244050ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/linklayer/ethernet.py000066400000000000000000000046701335744303000245050ustar00rootroot00000000000000""" IP protocol definitions. """ import ctypes import struct class Ethernet(ctypes.Structure): """ Represents an Ethernet frame. """ _fields_ = [('type', ctypes.c_ushort)] payload = None def __init__(self, packet, layers=0): super(Ethernet, self).__init__() (dst, src, self.type) = struct.unpack('!6s6sH', packet[:14]) self.dst = bytearray(dst) self.src = bytearray(src) assert len(self.dst) == 6 assert len(self.src) == 6 self.payload = packet[14:] if layers: self.load_network(layers) def load_network(self, layers=1): """ Given an Ethernet frame, determine the appropriate sub-protocol; If layers is greater than zerol determine the type of the payload and load the appropriate type of network packet. It is expected that the payload be a hexified string. The layers argument determines how many layers to descend while parsing the packet. """ if layers: ctor = payload_type(self.type)[0] if ctor: ctor = ctor payload = self.payload self.payload = ctor(payload, layers - 1) else: # if no type is found, do not touch the packet. pass def __str__(self): dst = b':'.join([('%02x' % o).encode('ascii') for o in self.dst]) src = b':'.join([('%02x' % o).encode('ascii') for o in self.src]) frame = 'ethernet from %s to %s type %s' frame = frame % (src, dst, payload_type(self.type)[1]) return frame def strip_ethernet(packet): """ Strip the Ethernet frame from a packet. """ if not isinstance(packet, Ethernet): packet = Ethernet(packet) payload = packet.payload return payload def payload_type(ethertype): """ Returns the appropriate payload constructor based on the supplied EtherType. """ if ethertype == 0x0800: from pcapfile.protocols.network.ip import IP return (IP, 'IPv4') # elif ethertype == 0x0806: # from pcapfile.protocols.network.arp import ARP # return (ARP, 'ARP') # elif ethertype == 0x0835: # from pcapfile.protocols.network.rarp import RARP # return (RARP, 'RARP') # elif ethertype == 0x08DD: # from pcapfile.protocols.network.ipv6 import IPv6 # return (IPv6, 'IPv6') else: return (None, 'unknown') pypcapfile-master/pcapfile/protocols/linklayer/wifi.py000066400000000000000000002504741335744303000236320ustar00rootroot00000000000000#!/usr/bin/python """ Wi-Fi protocol definitions current supports for packets below Management -Probe Request -Probe Response -Beacon Control -RTS -CTS -Block Acknowledgement Data -QoS Data Also have Radiotap support http://www.radiotap.org/defined-fields """ import ctypes import struct import logging import operator import collections # wlan.fc.type _CATEGORIES_ = {0: 'management', 1: 'control', 2: 'data'} _SUBTYPES_ = {} # wlan.fc.type_subtype _SUBTYPES_[0] = { 0: 'Association Request', 1: 'Association Response', 2: 'Reassociation Request', 3: 'Reassociation Response', 4: 'Probe Request', 5: 'Probe Response', 8: 'Beacon', 9: 'ATIM', 10: 'Disassociation', 11: 'Authentication', 12: 'Deauthentication', 13: 'Action', 14: 'Action No ACK' } _SUBTYPES_[1] = { 5: 'VHT NDP Announcement', 7: 'Control Wrapper', 8: 'BAR', 9: 'BACK', 10: 'PS-POLL', 11: 'RTS', 12: 'CTS', 13: 'ACK', 14: 'CF-end', 15: 'CF-end + CF-ack' } _SUBTYPES_[2] = { 0: 'Data', 1: 'Data + CF-ack', 2: 'Data + CF-poll', 3: 'Data+CF-ack+CF-poll', 4: 'Null', 5: 'CF-ack', 6: 'CF-poll', 7: 'CF-ack+CF-poll', 8: 'QoS data', 9: 'QoS data + CF-ack', 10: 'QoS data + CF-poll', 11: 'QoS data + CF-ack + CF-poll', 12: 'QoS Null', 13: 'Reserved', 14: 'Qos + CF-poll(no data)', 15: 'Qos + CF-ack(no data)' } # wlan_mgt.tag MNGMT_TAGS = { 0: "TAG_SSID", 1: "TAG_SUPP_RATES", 2: "TAG_FH_PARAMETER", 3: "TAG_DS_PARAMETER", 4: "TAG_CF_PARAMETER", 5: "TAG_TIM", 6: "TAG_IBSS_PARAMETER", 7: "TAG_COUNTRY_INFO", 8: "TAG_FH_HOPPING_PARAMETER", 9: "TAG_FH_HOPPING_TABLE", 10: "TAG_REQUEST", 11: "TAG_QBSS_LOAD", 12: "TAG_EDCA_PARAM_SET", 13: "TAG_TSPEC", 14: "TAG_TCLAS", 15: "TAG_SCHEDULE", 16: "TAG_CHALLENGE_TEXT", 32: "TAG_POWER_CONSTRAINT", 33: "TAG_POWER_CAPABILITY", 34: "TAG_TPC_REQUEST", 35: "TAG_TPC_REPORT", 36: "TAG_SUPPORTED_CHANNELS", 37: "TAG_CHANNEL_SWITCH_ANN", 38: "TAG_MEASURE_REQ", 39: "TAG_MEASURE_REP", 40: "TAG_QUIET", 41: "TAG_IBSS_DFS", 42: "TAG_ERP_INFO", 43: "TAG_TS_DELAY", 44: "TAG_TCLAS_PROCESS", 45: "TAG_HT_CAPABILITY", 46: "TAG_QOS_CAPABILITY", 47: "TAG_ERP_INFO_OLD", 48: "TAG_RSN_IE", 50: "TAG_EXT_SUPP_RATES", 51: "TAG_AP_CHANNEL_REPORT", 52: "TAG_NEIGHBOR_REPORT", 53: "TAG_RCPI", 54: "TAG_MOBILITY_DOMAIN", 55: "TAG_FAST_BSS_TRANSITION", 56: "TAG_TIMEOUT_INTERVAL", 57: "TAG_RIC_DATA", 58: "TAG_DSE_REG_LOCATION", 59: "TAG_SUPPORTED_OPERATING_CLASSES", 60: "TAG_EXTENDED_CHANNEL_SWITCH_ANNOUNCEMENT", 61: "TAG_HT_INFO", 62: "TAG_SECONDARY_CHANNEL_OFFSET", 63: "TAG_BSS_AVG_ACCESS_DELAY", 64: "TAG_ANTENNA", 65: "TAG_RSNI", 66: "TAG_MEASURE_PILOT_TRANS", 67: "TAG_BSS_AVB_ADM_CAPACITY", 68: "TAG_BSS_AC_ACCESS_DELAY", 69: "TAG_TIME_ADV", 70: "TAG_RM_ENABLED_CAPABILITY", 71: "TAG_MULTIPLE_BSSID", 72: "TAG_20_40_BSS_CO_EX", 73: "TAG_20_40_BSS_INTOL_CH_REP", 74: "TAG_OVERLAP_BSS_SCAN_PAR", 75: "TAG_RIC_DESCRIPTOR", 76: "TAG_MMIE", 78: "TAG_EVENT_REQUEST", 79: "TAG_EVENT_REPORT", 80: "TAG_DIAGNOSTIC_REQUEST", 81: "TAG_DIAGNOSTIC_REPORT", 82: "TAG_LOCATION_PARAMETERS", 83: "TAG_NO_BSSID_CAPABILITY", 84: "TAG_SSID_LIST", 85: "TAG_MULTIPLE_BSSID_INDEX", 86: "TAG_FMS_DESCRIPTOR", 87: "TAG_FMS_REQUEST", 88: "TAG_FMS_RESPONSE", 89: "TAG_QOS_TRAFFIC_CAPABILITY", 90: "TAG_BSS_MAX_IDLE_PERIOD", 91: "TAG_TFS_REQUEST", 92: "TAG_TFS_RESPONSE", 93: "TAG_WNM_SLEEP_MODE", 94: "TAG_TIM_BROADCAST_REQUEST", 95: "TAG_TIM_BROADCAST_RESPONSE", 96: "TAG_COLLOCATED_INTER_REPORT", 97: "TAG_CHANNEL_USAGE", 98: "TAG_TIME_ZONE", 99: "TAG_DMS_REQUEST", 100: "TAG_DMS_RESPONSE", 101: "TAG_LINK_IDENTIFIER", 102: "TAG_WAKEUP_SCHEDULE", 104: "TAG_CHANNEL_SWITCH_TIMING", 105: "TAG_PTI_CONTROL", 106: "TAG_PU_BUFFER_STATUS", 107: "TAG_INTERWORKING", 108: "TAG_ADVERTISEMENT_PROTOCOL", 109: "TAG_EXPIDITED_BANDWIDTH_REQ", 110: "TAG_QOS_MAP_SET", 111: "TAG_ROAMING_CONSORTIUM", 112: "TAG_EMERGENCY_ALERT_ID", 113: "TAG_MESH_CONFIGURATION", 114: "TAG_MESH_ID", 115: "TAG_MESH_LINK_METRIC_REPORT", 116: "TAG_CONGESTION_NOTIFICATION", 117: "TAG_MESH_PEERING_MGMT", 118: "TAG_MESH_CHANNEL_SWITCH", 119: "TAG_MESH_AWAKE_WINDOW", 120: "TAG_BEACON_TIMING", 121: "TAG_MCCAOP_SETUP_REQUEST", 122: "TAG_MCCAOP_SETUP_REPLY", 123: "TAG_MCCAOP_ADVERTISEMENT", 124: "TAG_MCCAOP_TEARDOWN", 125: "TAG_GANN", 126: "TAG_RANN", 127: "TAG_EXTENDED_CAPABILITIES", 128: "TAG_AGERE_PROPRIETARY", 130: "TAG_MESH_PREQ", 131: "TAG_MESH_PREP", 132: "TAG_MESH_PERR", 133: "TAG_CISCO_CCX1_CKIP", 136: "TAG_CISCO_CCX2", 137: "TAG_PXU", 138: "TAG_PXUC", 139: "TAG_AUTH_MESH_PEERING_EXCH", 140: "TAG_MIC", 141: "TAG_DESTINATION_URI", 142: "TAG_U_APSD_COEX", 143: "TAG_WAKEUP_SCHEDULE_AD", 144: "TAG_EXTENDED_SCHEDULE", 145: "TAG_STA_AVAILABILITY", 146: "TAG_DMG_TSPEC", 147: "TAG_NEXT_DMG_ATI", 148: "TAG_DMG_CAPABILITIES", 149: "TAG_CISCO_CCX3", 150: "TAG_CISCO_VENDOR_SPECIFIC", 151: "TAG_DMG_OPERATION", 152: "TAG_DMG_BSS_PRAMTER_CHANGE", 153: "TAG_DMG_BEAM_REFINEMENT", 154: "TAG_CHANNEL_MEASURMENT_FB", 157: "TAG_AWAKE_WINDOW", 158: "TAG_MULTI_BAND", 159: "TAG_ADDBA_EXT", 160: "TAG_NEXTPCP_LIST", 161: "TAG_PCP_HANDOVER", 162: "TAG_DMG_LINK_MARGIN", 163: "TAG_SWITCHING_STREAM", 164: "TAG_SESSION_TRANSMISSION", 165: "TAG_DYN_TONE_PAIR_REP", 166: "TAG_CLUSTER_REP", 167: "TAG_RELAY_CAPABILITIES", 168: "TAG_RELAY_TRANSFER_PARAM", 169: "TAG_BEAMLINK_MAINTAINCE", 170: "TAG_MULTIPLE_MAC_SUBLAYERS", 171: "TAG_U_PID", 172: "TAG_DMG_LINK_ADAPTION_ACK", 173: "TAG_SYMBOL_PROPRIETARY", 174: "TAG_MCCAOP_ADVERTISEMENT_OV", 175: "TAG_QUIET_PERIOD_REQ", 177: "TAG_QUIET_PERIOD_RES", 182: "TAG_ECPAC_POLICY", 183: "TAG_CLUSTER_TIME_OFFSET", 190: "TAG_ANTENNA_SECTOR_ID", 191: "TAG_VHT_CAPABILITY", 192: "TAG_VHT_OPERATION", 193: "TAG_EXT_BSS_LOAD", 194: "TAG_WIDE_BW_CHANNEL_SWITCH", 195: "TAG_VHT_TX_PWR_ENVELOPE", 196: "TAG_CHANNEL_SWITCH_WRAPPER", 199: "TAG_OPERATING_MODE_NOTIFICATION", 221: "TAG_VENDOR_SPECIFIC_IE" } def WIFI(frame, no_rtap=False): """calls wifi packet discriminator and constructor. :frame: ctypes.Structure :no_rtap: Bool :return: packet object in success :return: int -1 on known error :return: int -2 on unknown error """ pack = None try: pack = WiHelper.get_wifi_packet(frame, no_rtap) except Exception as e: logging.exception(e) return pack class WiHelper: """Wi-Fi packet discriminator class. Identifies type and subtype of packet, then trigs packet object creation. """ @staticmethod def get_wifi_packet(frame, no_rtap=False): """Discriminates Wi-Fi packet and creates packet object. :frame: ctypes.Structure :no_rtap: Bool :return: obj Wi-Fi packet """ _, packet = WiHelper._strip_rtap(frame) frame_control = struct.unpack('BB', packet[:2]) cat = (frame_control[0] >> 2) & 0b0011 s_type = frame_control[0] >> 4 if cat not in _CATEGORIES_.keys(): logging.warning("unknown category: %d" % (cat)) return Unknown(frame, no_rtap) if s_type not in _SUBTYPES_[cat].keys(): logging.warning("unknown subtype %d in %s category" % (s_type, _CATEGORIES_[cat])) return Unknown(frame, no_rtap) if cat == 0: if s_type == 4: return ProbeReq(frame, no_rtap) elif s_type == 5: return ProbeResp(frame, no_rtap) elif s_type == 8: return Beacon(frame, no_rtap) else: return Management(frame, no_rtap) elif cat == 1: if s_type == 11: return RTS(frame, no_rtap) elif s_type == 12: return CTS(frame, no_rtap) elif s_type == 9: return BACK(frame, no_rtap) else: return Control(frame, no_rtap) elif cat == 2: if s_type == 8: return QosData(frame, no_rtap, parse_amsdu=True) else: return Data(frame, no_rtap) @staticmethod def _strip_rtap(frame): """strip injected radiotap header. :return: ctypes.Structure radiotap header :return: ctypes.Structure actual layer 2 Wi-Fi payload """ rtap_len = WiHelper.__get_rtap_len(frame) rtap = frame[:rtap_len] packet = frame[rtap_len:] return rtap, packet @staticmethod def __get_rtap_len(frame): """parse length of radiotap header. :packet: ctypes.structure :return: int """ r_len = struct.unpack('H', frame[2:4]) return r_len[0] class Radiotap(ctypes.Structure): """Radiotap Header Parser Class. Radiotap headers summarize physical layer parameters of Wi-Fi packet, such as MCS(modulation and coding scheme), NSS(number of spatial streams), BW(bandwidth) for all common protocol types(802.11a, 802.11n, 802.11ac etc.) see -> http://www.radiotap.org/defined-fields see -> https://github.com/boundary/wireshark/blob/master/epan/dissectors/packet-ieee80211-radiotap-defs.h """ _rfields_ = [('vers', ctypes.c_uint8), ('pad', ctypes.c_uint8), ('len', ctypes.c_uint16), ('present.tsft', ctypes.c_bool), ('present.flags', ctypes.c_bool), ('present.rate', ctypes.c_bool), ('present.channel', ctypes.c_bool), ('present.fhss', ctypes.c_bool), ('present.dbm_antsignal', ctypes.c_bool), ('present.dbm_antnoise', ctypes.c_bool), ('present.lock_quality', ctypes.c_bool), ('present.tx_attenuation', ctypes.c_bool), ('present.db_tx_attenuation', ctypes.c_bool), ('present.dbm_tx_power', ctypes.c_bool), ('present.antenna', ctypes.c_bool), ('present.db_antsignal', ctypes.c_bool), ('present.db_antnoise', ctypes.c_bool), ('present.rxflags', ctypes.c_bool), ('present.txflags', ctypes.c_bool), ('present.rts_retries', ctypes.c_bool), ('present.data_retries', ctypes.c_bool), ('present.xchannel', ctypes.c_bool), ('present.mcs', ctypes.c_bool), ('present.ampdu', ctypes.c_bool), ('present.vht', ctypes.c_bool), ('present.rtap_ns', ctypes.c_bool), ('present.ven_ns', ctypes.c_bool), ('present.ext', ctypes.c_bool), ('mactime', ctypes.c_uint64), ('flags.cfp', ctypes.c_bool), ('flags.preamble', ctypes.c_bool), ('flags.wep', ctypes.c_bool), ('flags.fragmentation', ctypes.c_bool), ('flags.fcs', ctypes.c_bool), ('flags.datapad', ctypes.c_bool), ('flags.badfcs', ctypes.c_bool), ('flags.shortgi', ctypes.c_bool), ('rate', ctypes.c_uint), ('chan.freq', ctypes.c_uint), ('chan.turbo', ctypes.c_bool), ('chan.cck', ctypes.c_bool), ('chan.ofdm', ctypes.c_bool), ('chan.two_g', ctypes.c_bool), ('chan.five_g', ctypes.c_bool), ('chan.passive', ctypes.c_bool), ('chan.dynamic', ctypes.c_bool), ('chan.gfsk', ctypes.c_bool), ('chan.gsm', ctypes.c_bool), ('chan.static_turbo', ctypes.c_bool), ('chan.half_rate', ctypes.c_bool), ('chan.quarter_rate', ctypes.c_bool), ('fhss.hopset', ctypes.c_int), ('fhss.pattern', ctypes.c_uint), ('dbm_antsignal', ctypes.c_uint), ('dbm_antnoise', ctypes.c_uint), ('lock_quality', ctypes.c_uint), ('tx_attenuation', ctypes.c_uint), ('db_tx_attenuation', ctypes.c_uint), ('dbm_tx_power', ctypes.c_uint), ('antenna', ctypes.c_uint), ('db_antsignal', ctypes.c_uint), ('db_antnoise', ctypes.c_uint), ('rxflags.reserved', ctypes.c_bool), ('rxflags.badplcp', ctypes.c_bool), ('txflags', ctypes.c_uint), ('rts_retries', ctypes.c_uint), ('data_retries', ctypes.c_uint), ('xchannel.freq', ctypes.c_uint), ('xchannel.channel', ctypes.c_uint), ('xchannel.max_power', ctypes.c_uint), ('xchannel.flags.turbo', ctypes.c_bool), ('xchannel.flags.cck', ctypes.c_bool), ('xchannel.flags.ofdm', ctypes.c_bool), ('xchannel.flags.two_g', ctypes.c_bool), ('xchannel.flags.five_g', ctypes.c_bool), ('xchannel.flags.passive', ctypes.c_bool), ('xchannel.flags.dynamic', ctypes.c_bool), ('xchannel.flags.gfsk', ctypes.c_bool), ('xchannel.flags.gsm', ctypes.c_bool), ('xchannel.flags.sturbo', ctypes.c_bool), ('xchannel.flags.half', ctypes.c_bool), ('xchannel.flags.quarter', ctypes.c_bool), ('xchannel.flags.ht_20', ctypes.c_bool), ('xchannel.flags.ht_40u', ctypes.c_bool), ('xchannel.flags.ht_40d', ctypes.c_bool), ('mcs.known', ctypes.c_uint8), ('mcs.index', ctypes.c_uint8), ('mcs.have_bw', ctypes.c_bool), ('mcs.have_mcs', ctypes.c_bool), ('mcs.have_gi', ctypes.c_bool), ('mcs.have_format', ctypes.c_bool), ('mcs.have_fec', ctypes.c_bool), ('mcs.have_stbc', ctypes.c_bool), ('mcs.have_ness', ctypes.c_bool), ('mcs.ness_bit1', ctypes.c_bool), ('ampdu.refnum', ctypes.c_uint), ('ampdu.crc_val', ctypes.c_uint8), ('ampdu.reserved', ctypes.c_uint8), ('ampdu.flags.report_zerolen', ctypes.c_bool), ('ampdu.flags.is_zerolen', ctypes.c_bool), ('ampdu.flags.lastknown', ctypes.c_bool), ('ampdu.flags.last', ctypes.c_bool), ('ampdu.flags.delim_crc_error', ctypes.c_bool), ('vht.known_bits', ctypes.c_char_p), ('vht.have_stbc', ctypes.c_bool), ('vht.have_txop_ps', ctypes.c_bool), ('vht.have_gi', ctypes.c_bool), ('vht.have_sgi_nsym_da', ctypes.c_bool), ('vht.have_ldpc_extra', ctypes.c_bool), ('vht.have_beamformed', ctypes.c_bool), ('vht.have_bw', ctypes.c_bool), ('vht.have_gid', ctypes.c_bool), ('vht.have_paid', ctypes.c_bool), ('vht.flag_bits', ctypes.c_bool), ('vht.stbc', ctypes.c_bool), ('vht.txop_ps', ctypes.c_bool), ('vht.gi', ctypes.c_bool), ('vht.sgi_nysm_da', ctypes.c_bool), ('vht.ldpc_extra', ctypes.c_bool), ('vht.beamformed', ctypes.c_bool), ('vht.group_id', ctypes.c_bool), ('vht.partial_id', ctypes.c_bool), ('vht.bw', ctypes.c_uint), ('vht.user_0.nss', ctypes.c_bool), ('vht.user_0.mcs', ctypes.c_bool), ('vht.user_0.coding', ctypes.c_bool), ('vht.user_1.nss', ctypes.c_bool), ('vht.user_1.mcs', ctypes.c_bool), ('vht.user_1.coding', ctypes.c_bool), ('vht.user_2.nss', ctypes.c_bool), ('vht.user_2.mcs', ctypes.c_bool), ('vht.user_2.coding', ctypes.c_bool), ('vht.user_3.nss', ctypes.c_bool), ('vht.user_3.mcs', ctypes.c_bool), ('vht.user_3.coding', ctypes.c_bool), ('prot_type', ctypes.c_char_p)] # Wireshark syntax conjugates of fields in object _r_shark_ = {'radiotap.version': 'vers', 'radiotap.pad': 'pad', 'radiotap.length': 'len', 'radiotap.present.tsft': 'present.tsft', 'radiotap.present.flags': 'present.flags', 'radiotap.present.rate': 'present.rate', 'radiotap.present.channel': 'present.channel', 'radiotap.present.fhss': 'present.fhss', 'radiotap.present.dbm_antsignal': 'present.dbm_antsignal', 'radiotap.present.dbm_antnoise': 'present.dbm_antnoise', 'radiotap.present.lock_quality': 'present.lock_quality', 'radiotap.present.tx_attenuation': 'present.tx_attenuation', 'radiotap.present.db_tx_attenuation': 'present.db_tx_attenuation', 'radiotap.present.dbm_tx_power': 'present.dbm_tx_power', 'radiotap.present.antenna': 'present.antenna', 'radiotap.present.db_antsignal': 'present.db_antsignal', 'radiotap.present.db_antnoise': 'present.db_antnoise', 'radiotap.present.rxflags': 'present.rxflags', 'radiotap.present.xchannel': 'present.xchannel', 'radiotap.present.mcs': 'present.mcs', 'radiotap.present.ampdu': 'present.ampdu', 'radiotap.present.vht': 'present.vht', 'radiotap.present.rtap_ns': 'present.rtap_ns', 'radiotap.present.vendor_ns': 'present.ven_ns', 'radiotap.present.ext': 'present.ext', 'radiotap.mactime': 'mactime', 'radiotap.flags.cfp': 'flags.cfp', 'radiotap.flags.preamble': 'flags.preamble', 'radiotap.flags.wep': 'flags.wep', 'radiotap.flags.frag': 'flags.fragmentation', 'radiotap.flags.fcs': 'flags.fcs', 'radiotap.flags.datapad': 'flags.datapad', 'radiotap.flags.badfcs': 'flags.badfcs', 'radiotap.flags.shortgi': 'flags.shortgi', 'radiotap.datarate': 'rate', 'radiotap.channel.freq': 'chan.freq', 'radiotap.channel.flags.turbo': 'chan.turbo', 'radiotap.channel.flags.cck': 'chan.cck', 'radiotap.channel.flags.ofdm': 'chan.ofdm', 'radiotap.channel.flags.2ghz': 'chan.two_g', 'radiotap.channel.flags.5ghz': 'chan.five_g', 'radiotap.channel.flags.passive': 'chan.passive', 'radiotap.channel.flags.dynamic': 'chan.dynamic', 'radiotap.channel.flags.gfsk': 'chan.gfsk', 'radiotap.channel.flags.gsm': 'chan.gsm', 'radiotap.channel.flags.sturbo': 'chan.static_turbo', 'radiotap.channel.flags.half': 'chan.half_rate', 'radiotap.channel.flags.quarter': 'chan.quarter_rate', 'radiotap.fhss.hopset': 'fhss.hopset', 'radiotap.fhss.pattern': 'fhss.pattern', 'radiotap.dbm_antsignal': 'dbm_antsignal', 'radiotap.dbm_antnoise': 'dbm_antnoise', 'radiotap.antenna': 'antenna', 'radiotap.db_antsignal': 'db_antsignal', 'radiotap.db_antnoise': 'db_antnoise', 'radiotap.rxflags.badplcp': 'rxflags.badplcp', 'radiotap.xchannel.freq': 'xchannel.freq', 'radiotap.xchannel.channel': 'xchannel.channel', 'radiotap.xchannel.flags.turbo': 'xchannel.flags.turbo', 'radiotap.xchannel.flags.cck': 'xchannel.flags.cck', 'radiotap.xchannel.flags.ofdm': 'xchannel.flags.ofdm', 'radiotap.xchannel.flags.2ghz': 'xchannel.flags.two_g', 'radiotap.xchannel.flags.5ghz': 'xchannel.flags.five_g', 'radiotap.xchannel.flags.passive': 'xchannel.flags.passive', 'radiotap.xchannel.flags.dynamic': 'xchannel.flags.dynamic', 'radiotap.xchannel.flags.gfsk': 'xchannel.flags.gfsk', 'radiotap.xchannel.flags.gsm': 'xchannel.flags.gsm', 'radiotap.xchannel.flags.sturbo': 'xchannel.flags.sturbo', 'radiotap.xchannel.flags.half': 'xchannel.flags.half', 'radiotap.xchannel.flags.quarter': 'xchannel.flags.quarter', 'radiotap.xchannel.flags.ht20': 'xchannel.flags.ht_20', 'radiotap.xchannel.flags.ht40u': 'xchannel.flags.ht_40u', 'radiotap.xchannel.flags.ht40d': 'xchannel.flags.ht_40d', 'radiotap.mcs.known': 'mcs.known', 'radiotap.mcs.index': 'mcs.index', 'radiotap.mcs.have_bw': 'mcs.have_bw', 'radiotap.mcs.have_gi': 'mcs.have_gi', 'radiotap.mcs.have_format': 'mcs.have_format', 'radiotap.mcs.have_fec': 'mcs.have_fec', 'radiotap.mcs.have_stbc': 'mcs.have_stbc', 'radiotap.mcs.have_ness': 'mcs.have_ness', 'radiotap.mcs.ness_bit1': 'mcs.ness_bit1', 'radiotap.ampdu.reference': 'ampdu.refnum', 'radiotap.ampdu.crc_val': 'ampdu.crc_val', 'radiotap.ampdu.reserved': 'ampdu.reserved', 'radiotap.ampdu.flags.report_zerolen': 'ampdu.flags.report_zerolen', 'radiotap.ampdu.flags.is_zerolen': 'ampdu.flags.is_zerolen', 'radiotap.ampdu.flags.lastknown': 'ampdu.flags.lastknown', 'radiotap.ampdu.flags.last': 'ampdu.flags.last', 'radiotap.ampdu.flags.delim_crc_error': 'ampdu.flags.delim_crc_error', 'radiotap.vht.have_stbc': 'vht.have_stbc', 'radiotap.vht.have_txop_ps': 'vht.have_txop_ps', 'radiotap.vht.have_gi': 'vht.have_gi', 'radiotap.vht.have_sgi_nsym_da': 'vht.have_sgi_nsym_da', 'radiotap.vht.have_ldpc_extra': 'vht.have_ldpc_extra', # this does not seem with have_ prefix in wireshark 'radiotap.vht.have_beamformed': 'vht.have_beamformed', # creates conflict with ldpc_extra below; we keep radiotap 'radiotap.vht.have_bw': 'vht.have_bw', # syntax. 'radiotap.vht.have_gid': 'vht.have_gid', 'radiotap.vht.have_paid': 'vht.have_paid', 'radiotap.vht.stbc': 'vht.stbc', 'radiotap.vht.txop_ps': 'vht.txop_ps', 'radiotap.vht.gi': 'vht.gi', 'radiotap.vht.sgi_nysm_da': 'vht.sgi_nysm_da', 'radiotap.vht.ldpc_extra': 'vht.ldpc_extra', 'radiotap.vht.beamformed': 'vht.beamformed', 'radiotap.vht.gid': 'vht.group_id', 'radiotap.vht.paid': 'vht.partial_id', 'radiotap.vht.bw': 'vht.bw', 'radiotap.vht.nss.0': 'vht.user_0.nss', 'radiotap.vht.mcs.0': 'vht.user_0.mcs', 'radiotap.vht.coding.0': 'vht.user_0.coding', 'radiotap.vht.nss.1': 'vht.user_1.nss', 'radiotap.vht.mcs.1': 'vht.user_1.mcs', 'radiotap.vht.coding.1': 'vht.user_1.coding', 'radiotap.vht.nss.2': 'vht.user_2.nss', 'radiotap.vht.mcs.2': 'vht.user_2.mcs', 'radiotap.vht.coding.2': 'vht.user_2.coding', 'radiotap.vht.nss.3': 'vht.user_3.nss', 'radiotap.vht.mcs.3': 'vht.user_3.mcs', 'radiotap.vht.coding.3': 'vht.user_3.coding'} def __init__(self, rtap_bytes): """Constructor method. :rtap_bytes: ctypes.Structure """ super(Radiotap, self).__init__() self._raw = {} # contains raw bytes, for debugging purposes self._bits = {} # contains bitstrings, for debugging purposes idx = 0 self._rtap = rtap_bytes # parse radiotap headers self.vers = Radiotap.strip_vers(self._rtap[idx:idx + 1]) idx += 1 self.pad = Radiotap.strip_pad(self._rtap[idx:idx + 1]) idx += 1 self.len = Radiotap.strip_len(self._rtap[idx:idx + 2]) idx += 2 self.present, self.present_bits = Radiotap.strip_present(self._rtap[idx:idx + 4]) idx += 4 # parse radiotap payload if self.present.tsft: # 8 byte idx, self.mactime = self.strip_tsft(idx) if self.present.flags: # 1 byte idx, self.flags = self.strip_flags(idx) if self.present.rate: # 1 byte idx, self.rate = self.strip_rate(idx) if self.present.channel: # 2 byte (align 2 byte) idx, self.chan = self.strip_chan(idx) if self.present.fhss: # 2 byte idx, self.fhss = self.strip_fhss(idx) if self.present.dbm_antsignal: # 1 byte idx, self.dbm_antsignal = self.strip_dbm_antsignal(idx) if self.present.dbm_antnoise: # 1 byte idx, self.dbm_antnoise = self.strip_dbm_antnoise(idx) if self.present.lock_quality: # 2 byte (align 2 byte) idx, self.lock_quality = self.strip_lock_quality(idx) if self.present.tx_attenuation: # 1 byte (align 2 byte) idx, self.tx_attenuation = self.strip_tx_attenuation(idx) if self.present.db_tx_attenuation: # 1 byte (align 2 byte) idx, self.db_tx_attenuation = self.strip_db_tx_attenuation(idx) if self.present.dbm_tx_power: # 1 byte (align 1 byte) idx, self.dbm_tx_power = self.strip_dbm_tx_power(idx) if self.present.antenna: # 1 byte idx, self.antenna = self.strip_antenna(idx) if self.present.db_antsignal: # 1 byte idx, self.db_antsignal = self.strip_db_antsignal(idx) if self.present.db_antnoise: # 1 byte idx, self.db_antnoise = self.strip_db_antnoise(idx) if self.present.rxflags: # 2 byte (align 2 byte) idx, self.rxflags = self.strip_rx_flags(idx) if self.present.txflags: # 1 byte (align 2 byte) idx, self.txflags = self.strip_tx_flags(idx) if self.present.rts_retries: # 1 byte idx, self.rts_retries = self.strip_rts_retries(idx) if self.present.data_retries: # 1 byte idx, self.data_retries = self.strip_data_retries(idx) if self.present.xchannel: # 7 byte (align 2 byte) idx, self.xchannel = self.strip_xchannel(idx) if self.present.mcs: # 3 byte (align 1 byte) idx, self.mcs = self.strip_mcs(idx) if self.present.ampdu: # 8 byte (align 4 byte) idx, self.ampdu = self.strip_ampdu(idx) if self.present.vht: # 12 byte (align 2 byte) idx, self.vht = self.strip_vht(idx) self.prot_type = self.extract_protocol() @staticmethod def strip_vers(payload): """strip(1 byte) radiotap.version :payload: ctypes.Structure :return: int """ return struct.unpack('B', payload)[0] @staticmethod def strip_pad(payload): """strip(1 byte) radiotap.pad :payload: ctypes.Structure :return: int """ return struct.unpack('B', payload)[0] @staticmethod def strip_len(payload): """strip(2 byte) radiotap.length :payload: ctypes.Structure :return: int """ return struct.unpack('H', payload)[0] @staticmethod def strip_present(payload): """strip(4 byte) radiotap.present. Those are flags that identify existence of incoming radiotap meta-data. :idx: int :return: str :return: namedtuple """ present = collections.namedtuple( 'present', ['tsft', 'flags', 'rate', 'channel', 'fhss', 'dbm_antsignal', 'dbm_antnoise', 'lock_quality', 'tx_attenuation', 'db_tx_attenuation', 'dbm_tx_power', 'antenna', 'db_antsignal', 'db_antnoise', 'rxflags', 'txflags', 'rts_retries', 'data_retries', 'xchannel', 'mcs', 'ampdu', 'vht', 'rtap_ns', 'ven_ns', 'ext']) val = struct.unpack('> 4 mcs = (mcs_nss & 0xf0) >> 4 coding = (coding & 2**i) >> i if i == 0: vht.user_0 = user(nss, mcs, coding) elif i == 1: vht.user_1 = user(nss, mcs, coding) elif i == 2: vht.user_2 = user(nss, mcs, coding) elif i == 3: vht.user_3 = user(nss, mcs, coding) return idx + 12, vht def extract_protocol(self): """extract 802.11 protocol from radiotap.channel.flags :return: str protocol name one of below in success [.11a, .11b, .11g, .11n, .11ac] None in fail """ if self.present.mcs: return '.11n' if self.present.vht: return '.11ac' if self.present.channel and hasattr(self, 'chan'): if self.chan.five_g: if self.chan.ofdm: return '.11a' elif self.chan.two_g: if self.chan.cck: return '.11b' elif self.chan.ofdm or self.chan.dynamic: return '.11g' return 'None' @staticmethod def align(val, align): """ :val: int :align: int :return: int """ return (val + align - 1) & ~(align - 1) class Wifi(ctypes.Structure): """Base Wi-Fi Packet""" _fields_ = [('name', ctypes.c_char_p), # name of packet ('vers', ctypes.c_ushort), # version ('category', ctypes.c_ushort), # category ('subtype', ctypes.c_ushort), # subtype ('ds', ctypes.c_char_p), # distribution system ('to_ds', ctypes.c_bool), # to distribution system -> wlan.fc.ds[0] ('from_ds', ctypes.c_bool), # from distribution system -> wlan.fc.ds[1] ('frag', ctypes.c_bool), # more flag ('retry', ctypes.c_bool), # retry ('power_mgmt', ctypes.c_bool), # power management ('order', ctypes.c_bool), # order ('wep', ctypes.c_bool), # wired equivalent privacy ('duration', ctypes.c_uint)] # duration # Wireshark syntax conjugates of fields in object (base) _shark_ = {'wlan.fc.version': 'vers', 'wlan.fc.type': 'category', 'wlan.fc.type_subtype': 'subtype', 'wlan.fc.ds': 'ds', 'wlan.fc.frag': 'frag', 'wlan.fc.retry': 'retry', 'wlan.fc.pwrmgt': 'power_mgmt', 'wlan.fc.wep': 'wep', 'wlan.fc.order': 'order', 'wlan.duration': 'duration'} def __init__(self, frame, no_rtap=False): """Constructor method. Parse common headers of all Wi-Fi frames. :frame: ctypes.Structure """ super(Wifi, self).__init__() self._raw = {} if not no_rtap: rtap_bytes, self._packet = WiHelper._strip_rtap(frame) self.radiotap = Radiotap(rtap_bytes) else: self._packet = frame self.radiotap = None f_cntrl = struct.unpack('BB', self._packet[:2]) # frame control flags = f_cntrl[1] self.vers = f_cntrl[0] & 0b0011 self.category = (f_cntrl[0] >> 2) & 0b0011 self.subtype = f_cntrl[0] >> 4 flag_bits = format(flags, '08b')[::-1] self.to_ds = int(flag_bits[0]) self.from_ds = int(flag_bits[1]) self.ds = b''.join([(flag_bits[0]).encode('ascii'), (flag_bits[1]).encode('ascii')]) self.frag = int(flag_bits[2]) self.retry = int(flag_bits[3]) self.power_mgmt = int(flag_bits[4]) self.more_data = int(flag_bits[5]) self.wep = int(flag_bits[6]) self.order = int(flag_bits[7]) # TODO: parse duration with respect to field/subfield # since some bits might be reserved for types like data (0x20) # https://community.arubanetworks.com/t5/Technology-Blog/802-11-Duration-ID-Field/ba-p/235872 self.duration = struct.unpack('H', self._packet[2:4])[0] # us self.name = None if self.category == 0: if self.subtype in _SUBTYPES_[0].keys(): self.name = _SUBTYPES_[0][self.subtype].encode('ascii') elif self.category == 1: if self.subtype in _SUBTYPES_[1].keys(): self.name = _SUBTYPES_[1][self.subtype].encode('ascii') elif self.category == 2: if self.subtype in _SUBTYPES_[2].keys(): self.name = _SUBTYPES_[2][self.subtype].encode('ascii') def get_shark_field(self, fields): """get parameters via wireshark syntax. out = x.get_shark_field('wlan.fc.type') out = x.get_shark_field(['wlan.fc.type', 'wlan.seq']) :fields: str or str[] :return: dict out[fields[0]] = val[0] or None out[fields[1]] = val[1] or None ... """ keys, exist, out = None, {}, None if isinstance(fields, str): fields = [fields] elif not isinstance(fields, list): logging.error('invalid input type') return None out = dict.fromkeys(fields) if hasattr(self, '_shark_'): exist.update(self._shark_) if hasattr(self, '_s_shark_'): exist.update(self._s_shark_) if hasattr(self.radiotap, '_r_shark_'): exist.update(self.radiotap._r_shark_) keys = exist.keys() for elem in fields: if elem in keys: obj_field, tmp = exist[elem], None try: tmp = operator.attrgetter(obj_field)(self) except AttributeError: tmp = None if not tmp: try: tmp = operator.attrgetter(obj_field)(self.radiotap) except AttributeError: tmp = None out[elem] = tmp return out @staticmethod def get_mac_addr(mac_addr): """converts bytes to mac addr format :mac_addr: ctypes.structure :return: str mac addr in format 11:22:33:aa:bb:cc """ mac_addr = bytearray(mac_addr) mac = b':'.join([('%02x' % o).encode('ascii') for o in mac_addr]) return mac def get_hex_repr(self): """wlan.fc.type_subtype hex representation :return: str """ return hex(self.category * 16 + self.subtype) def strip_mac_addrs(self): """strip mac address(each 6 byte) information. (wlan.ta, wlan.ra, wlan.sa, wlan.da) (transmitter, receiver, source, destination) :return: int index of sequence control :return: int index after mac addresses :return: str source address (sa) :return: str transmitter address (ta) :return: str receiver address (ra) :return: str destination address (da) :return: str basic service sed identifier (bssid) """ qos_idx, seq_idx = 0, 0 sa, ta, ra, da, bssid = None, None, None, None, None if self.to_ds == 1 and self.from_ds == 1: (ra, ta, da) = struct.unpack('!6s6s6s', self._packet[4:22]) sa = struct.unpack('!6s', self._packet[24:30])[0] qos_idx = 30 seq_idx = 22 elif self.to_ds == 0 and self.from_ds == 1: (ra, ta, sa) = struct.unpack('!6s6s6s', self._packet[4:22]) qos_idx = 24 seq_idx = 22 elif self.to_ds == 1 and self.from_ds == 0: (ra, ta, da) = struct.unpack('!6s6s6s', self._packet[4:22]) qos_idx = 24 seq_idx = 22 elif self.to_ds == 0 and self.from_ds == 0: (ra, ta, bssid) = struct.unpack('!6s6s6s', self._packet[4:22]) qos_idx = 24 seq_idx = 22 if ta is not None: ta = Wifi.get_mac_addr(ta) if ra is not None: ra = Wifi.get_mac_addr(ra) if sa is not None: sa = Wifi.get_mac_addr(sa) if da is not None: da = Wifi.get_mac_addr(da) if bssid is not None: bssid = Wifi.get_mac_addr(bssid) return seq_idx, qos_idx, sa, ta, ra, da, bssid def strip_seq_cntrl(self, idx): """strip(2 byte) wlan.seq(12 bit) and wlan.fram(4 bit) number information. :seq_cntrl: ctypes.Structure :return: int sequence number :return: int fragment number """ seq_cntrl = struct.unpack('H', self._packet[idx:idx + 2])[0] seq_num = seq_cntrl >> 4 frag_num = seq_cntrl & 0x000f return seq_num, frag_num def __repr__(self, show_rfields=True): """ :show_rfields: bool whether to show radiotap fields too. """ out_str = '' all_fields = [] if hasattr(self, '_fields_'): all_fields += self._fields_ if hasattr(self, '_sfields_'): all_fields += self._sfields_ if all_fields: for elem in all_fields: key = elem[0] try: val = operator.attrgetter(key)(self) except Exception: val = None if isinstance(val, list): if val: out_str += "{} [{}]\n".format(key, type(val[0])) else: out_str += "{} \n".format(str(key)) else: out_str += "{}: {}\n".format(str(key), str(val)) else: logging.error('instance does not have any field') return None if show_rfields and hasattr(self.radiotap, '_rfields_'): for elem in self.radiotap._rfields_: key = elem[0] try: val = operator.attrgetter(key)(self.radiotap) except Exception: val = None if val is not None: out_str += "radiotap.{}: {}\n".format(key, val) return out_str class Data(Wifi): """Base Data Packet (type: 2)""" def __init__(self, frame, no_rtap=False): """Constructor method. :packet: ctypes.Structure :no_rtap: Bool shall parse radiotap headers """ Wifi.__init__(self, frame, no_rtap) class QosData(Data): """Qos Data (type: 2, subtype: 8)""" _sfields_ = [('sa', ctypes.c_char_p), # source address ('ta', ctypes.c_char_p), # transmitter address ('ra', ctypes.c_char_p), # receiver address ('da', ctypes.c_char_p), # destionation address ('seq_num', ctypes.c_uint), # sequence number ('frag_num', ctypes.c_uint), # fragment number ('qos_pri', ctypes.c_uint), # qualit of service priority ('qos_bit', ctypes.c_bool), # quality of service bit ('qos_ack', ctypes.c_uint), # quality of service ack ('amsdupresent', ctypes.c_bool), # aggregated mac service data unit ('ccmp_extiv', ctypes.c_uint64), # counter mode chiper block ('payload', list)] # payload # Wireshark syntax conjugates of fields in object (subfield shark) _s_shark_ = {'wlan.sa': 'sa', 'wlan.ta': 'ta', 'wlan.ra': 'ra', 'wlan.da': 'da', 'wlan.seq': 'seq_num', 'wlan.frag': 'frag_num', 'wlan.qos.priority': 'qos_pri', 'wlan.qos.bit4': 'qos_bit', 'wlan.qos.ack': 'qos_ack', 'wlan.qos.amsdupresent': 'amsdupresent', 'wlan.ccmp.extiv': 'ccmp_extiv'} def __init__(self, frame, no_rtap=False, parse_amsdu=True): """Constructor method. :frame: ctypes.Structure :parse_amsdu: Bool shall parse aggregated mac service data unit """ Data.__init__(self, frame, no_rtap) idx = 0 self.sa = self.ta = self.ra = self.da = None self.seq_num = self.frag_num = None self.qos_pri = self.qos_bit = self.qos_ack = None self.ccmp_extiv = None self.payload = [] seq_idx, qos_idx, self.sa, self.ta, self.ra, self.da, _ = self.strip_mac_addrs() self.seq_num, self.frag_num = self.strip_seq_cntrl(seq_idx) idx = qos_idx incr, self.qos_pri, self.qos_bit, self.qos_ack, self.amsdupresent =\ self.strip_qos_cntrl(idx, self.radiotap.prot_type) idx += incr if self.wep == 1: incr, self.ccmp_extiv = self.strip_ccmp(idx) idx += incr if parse_amsdu: if self.amsdupresent != 0 and self.wep == 0: while idx < len(self._packet): msdu, offset = self.strip_msdu(idx) self.payload.append(msdu) idx += offset else: if self.wep == 0: msdu = {} offset, llc = self.strip_llc(idx) msdu['llc'] = llc msdu['payload'] = self._packet[idx + offset:] self.payload.append(msdu) else: self.payload.append({'payload': self._packet[idx:]}) def strip_qos_cntrl(self, idx, prot_type): """strip(2 byte) wlan.qos :idx: int :prot_type: string 802.11 protocol type(.11ac, .11a, .11n, etc) :return: int number of processed bytes :return: int qos priority :return: int qos bit :return: int qos acknowledgement :return: int amsdupresent(aggregated mac service data unit) """ qos_cntrl, = struct.unpack('H', self._packet[idx:idx + 2]) qos_cntrl_bits = format(qos_cntrl, '016b')[::-1] qos_pri = qos_cntrl & 0x000f qos_bit = int(qos_cntrl_bits[5]) qos_ack = int(qos_cntrl_bits[6:8], 2) amsdupresent = 0 if prot_type == '.11ac': amsdupresent = int(qos_cntrl_bits[7]) return 2, qos_pri, qos_bit, qos_ack, amsdupresent def strip_ccmp(self, idx): """strip(8 byte) wlan.ccmp.extiv CCMP Extended Initialization Vector :return: int number of processed bytes :return: ctypes.raw ccmp vector """ ccmp_extiv = None if len(self._packet[idx:]) >= 8: raw_bytes = self._packet[idx:idx + 8] ccmp_extiv, = struct.unpack_from('Q', raw_bytes, 0) return 8, ccmp_extiv def strip_msdu(self, idx): """strip single mac servis data unit(msdu) see -> https://mrncciew.com/2014/11/01/cwap-802-11-data-frame-aggregation/ :idx: int :return: dict msdu :return: int number of processed bytes """ # length of msdu payload has to be multiple of 4, # this guaranteed with padding padding = 0 len_payload = 0 msdu = { 'llc': {}, 'wlan.da': None, 'wlan.sa': None, 'payload': None, 'length': 0 } (da_mac, sa_mac) = struct.unpack('!6s6s', self._packet[idx:idx + 12]) msdu['wlan.da'] = Wifi.get_mac_addr(da_mac) msdu['wlan.sa'] = Wifi.get_mac_addr(sa_mac) idx += 12 msdu['length'] = struct.unpack('!H', self._packet[idx:idx + 2])[0] idx += 2 offset, msdu['llc'] = self.strip_llc(idx) idx += offset len_payload = msdu['length'] - offset msdu['payload'] = self._packet[idx:idx + len_payload] padding = 4 - (len_payload % 4) return msdu, msdu['length'] + padding + 12 def strip_llc(self, idx): """strip(4 or 8 byte) logical link control headers :return: int number of processed bytes :return: dict llc information see -> http://www.wildpackets.com/resources/compendium/ethernet/frame_snap_iee8023 ABBRVS. ssap: source service access point dsap: destination service access point SNAP(Subnetwork Acess Protocol) """ llc = {} snap = 170 llc_dsap = struct.unpack('B', self._packet[idx:idx + 1])[0] llc['dsap.dsap'] = llc_dsap >> 1 llc['dsap.ig'] = llc_dsap & 0b01 idx += 1 llc_ssap = struct.unpack('B', self._packet[idx:idx + 1])[0] llc['ssap.sap'] = llc_ssap >> 1 llc['ssap.cr'] = llc_ssap & 0b01 idx += 1 if llc_dsap == snap and llc_ssap == snap: llc_control = struct.unpack('B', self._packet[idx:idx + 1])[0] llc['control.u_modifier_cmd'] = llc_control >> 2 llc['control.ftype'] = llc_control & 0x03 idx += 1 llc['organization_code'] = self._packet[idx:idx + 3] idx += 3 llc['type'] = self._packet[idx:idx + 2] return 8, llc else: return 4, llc def __str__(self): frame = "%s (sa: %s, ta: %s, ra: %s, da: %s, ds: %s, seq: %s)" frame = frame % (self.name, self.sa, self.ta, self.ra, self.da, self.ds, self.seq_num) return frame class Management(Wifi): """Management Packet (type: 0)""" # commonly exists in some of the subtypes _capabilities_ = [('ess', ctypes.c_bool), # extended service set ('ibss', ctypes.c_bool), # indepent service set ('priv', ctypes.c_bool), # privacy ('short_pre', ctypes.c_bool), # short preamble ('pbcc', ctypes.c_bool), # packet binary convolutional code ('chan_agility', ctypes.c_bool), # channel agility ('spec_man', ctypes.c_bool), # spectrum management ('short_slot', ctypes.c_bool), # short slot time ('apsd', ctypes.c_bool), # automatic power save delivery ('radio_meas', ctypes.c_bool), # radio measurement ('dss_ofdm', ctypes.c_bool), # direct spread spectrum ('del_back', ctypes.c_bool), # delayed block acknowledgement ('imm_back', ctypes.c_bool)] # immediate block acknowledgement _scapabilities_ = {'wlan_mgt.fixed.capabilities.ess': 'ess', 'wlan_mgt.fixed.capabilities.ibss': 'ibss', 'wlan_mgt.fixed.capabilities.priv': 'priv', 'wlan_mgt.fixed.capabilities.preamble': 'short_pre', 'wlan_mgt.fixed.capabilities.pbcc': 'pbcc', 'wlan_mgt.fixed.capabilities.agility': 'chan_agility', 'wlan_mgt.fixed.capabilities.spec_man': 'spec_man', 'wlan_mgt.fixed.capabilities.short_slot_time': 'short_slot', 'wlan_mgt.fixed.capabilities.apsd': 'apsd', 'wlan_mgt.fixed.capabilities.radio_measurement': 'radio_meas', 'wlan_mgt.fixed.capabilities.dss_ofdm': 'dss_ofdm', 'wlan_mgt.fixed.capabilities.del_blk_ack': 'del_back', 'wlan_mgt.fixed_capabilities.imm_blk_ack': 'imm_back'} def __init__(self, frame, no_rtap=False): """Constructor Method :frame: ctypes.Structure :subtype: int """ Wifi.__init__(self, frame, no_rtap) self.tagged_params = [] self._raw_tagged_params = None self.timestamp = None self.interval = None self.fixed_capabils = None def __str__(self): return self.name @staticmethod def parse_tagged_params(raw_tagged_params): """strip tagged information elements wlan_mgt.tag which has generic type-length-value structure [type, length, value] type(1 byte), length(1 byte), value(varies) [wlan_mgt.tag.number, wlan_mgt.tag.length, payload] structured fields. :return: dict[] list of tagged params :return: int 0 in succ, 1 for """ fcs_len = 4 # wlan.fcs (4 bytes) idx = 0 tagged_params = [] while idx < len(raw_tagged_params) - fcs_len: tag_num, tag_len = struct.unpack('BB', raw_tagged_params[idx:idx + 2]) idx += 2 if len(raw_tagged_params) >= idx + tag_len: param = {} param['number'], param['length'] = tag_num, tag_len payload = raw_tagged_params[idx:idx + tag_len] if tag_num in MNGMT_TAGS: param['name'] = MNGMT_TAGS[tag_num] if MNGMT_TAGS[tag_num] == 'TAG_VENDOR_SPECIFIC_IE': param['payload'] = Management.parse_vendor_ie(payload) else: param['payload'] = payload else: param['name'] = None tagged_params.append(param) idx += tag_len else: logging.warning('out tag length header points out of boundary') log_msg = 'index: {p_idx}, pack_len: {p_len}' log_msg = log_msg.format(p_idx=idx + tag_len, p_len=len(raw_tagged_params)) logging.warning(log_msg) return 1, tagged_params return 0, tagged_params @staticmethod def get_fixed_capabils(payload): """strip(2 byte) wlan_mgt.fixed.capabilities :payload: ctypes.structure 2 byte :return: dict None in error """ if len(payload) != 2: return None capabils = {} fix_cap = struct.unpack('H', payload)[0] cap_bits = format(fix_cap, '016b')[::-1] capabils['ess'] = int(cap_bits[0]) # Extended Service Set capabils['ibss'] = int(cap_bits[1]) # Independent Basic Service Set capabils['priv'] = int(cap_bits[4]) # Privacy capabils['short_preamble'] = int(cap_bits[5]) # Short Preamble capabils['pbcc'] = int(cap_bits[6]) # Packet Binary Convolutional Code capabils['chan_agility'] = int(cap_bits[7]) # Channel Agility capabils['spec_man'] = int(cap_bits[8]) # Spectrum Management capabils['short_slot'] = int(cap_bits[10]) # Short Slot Time capabils['apsd'] = int(cap_bits[11]) # Automatic Power Save Delivery capabils['radio_meas'] = int(cap_bits[12]) # Radio Measurement capabils['dss_ofdm'] = int(cap_bits[13]) # Direct Spread Spectrum capabils['del_back'] = int(cap_bits[14]) # Delayed Block Acknowledgement capabils['imm_back'] = int(cap_bits[15]) # Immediate Block Acknowledgement return capabils @staticmethod def parse_vendor_ie(payload): """parse vendor specific information element oui -> organizationally unique identifier first 3 bytes of mac addresses see:https://www.wireshark.org/tools/oui-lookup.html strip wlan_mgt.tag.oui(3 bytes), wlan_mgt.tag.vendor.oui.type(1 byte) wlan_mgt.tag.vendor.data (varies) :payload: ctypes.structure :return: dict {'oui':00-11-22, 'oui_type':1, 'oui_data':ctypes.structure} """ output = {} oui = struct.unpack('BBB', payload[0:3]) oui = b'-'.join([('%02x' % o).encode('ascii') for o in oui]) oui_type = struct.unpack('B', payload[3:4])[0] oui_data = payload[4:] output['oui'] = oui.upper() output['oui_type'] = oui_type output['oui_data'] = oui_data return output @staticmethod def get_timestamp(payload): """strip wlan_mgt.fixed.timestamp(8 bytes) :payload: ctypes.structure :return: int None on error """ if len(payload) != 8: return None timestamp = struct.unpack('Q', payload)[0] return timestamp @staticmethod def get_interval(payload): """strip wlan_mgt.fixed.beacoN(2 bytes) beacon interval :payload: ctypes.structure :return: int None on error """ if len(payload) != 2: return None interval = struct.unpack('H', payload)[0] return interval @staticmethod def strip_fixed_params(payload): """strip(12 byte) wlan_mgt.fixed.all :payload: ctypes.structure :return: int timestamp :return: int beacon interval :return: dict capabilities """ if len(payload) != 12: return None, None, None idx = 0 timestamp = Management.get_timestamp(payload[idx:idx + 8]) idx += 8 interval = Management.get_interval(payload[idx:idx + 2]) idx += 2 capabils = Management.get_fixed_capabils(payload[idx:idx + 2]) return timestamp, interval, capabils @staticmethod def is_valid_mac_oui(mac_block): """checks whether mac block is in format of 00-11-22 or 00:11:22. :return: int """ if len(mac_block) != 8: return 0 if ':' in mac_block: if len(mac_block.split(':')) != 3: return 0 elif '-' in mac_block: if len(mac_block.split('-')) != 3: return 0 return 1 def set_fixed_capabils(self, capabils): """set keys of capabils into fields of object :capabils: dict """ self.ess = capabils['ess'] self.ibss = capabils['ibss'] self.priv = capabils['priv'] self.short_preamble = capabils['short_preamble'] self.pbcc = capabils['pbcc'] self.chan_agility = capabils['chan_agility'] self.spec_man = capabils['spec_man'] self.short_slot = capabils['short_slot'] self.apsd = capabils['apsd'] self.radio_meas = capabils['radio_meas'] self.dss_ofdm = capabils['dss_ofdm'] self.del_back = capabils['del_back'] self.imm_back = capabils['imm_back'] def get_vendor_ies(self, mac_block=None, oui_type=None): """vendor information element querying :mac_block: str first 3 bytes of mac addresses in format of 00-11-22 or 00:11:22 or 001122 :oui_type: int vendors ie type :return: int is valid mac_block format -1 is unknown :return: dict[] list of oui information elements -1 on error (invalid v """ vendor_ies = [] if mac_block is not None: if Management.is_valid_mac_oui(mac_block): mac_block = mac_block.upper() if ':' in mac_block: mac_block.replace(':', '-') else: logging.warning("invalid oui macblock") return None for elem in self.tagged_params: tag_num = elem['number'] if MNGMT_TAGS[tag_num] == 'TAG_VENDOR_SPECIFIC_IE': if mac_block is None: vendor_ies.append(elem) elif elem['payload']['oui'] == mac_block.encode('ascii'): if oui_type is None: vendor_ies.append(elem) elif elem['payload']['oui_type'] == oui_type: vendor_ies.append(elem) return vendor_ies class ProbeResp(Management): """Probe Response (type: 0, subtype: 5)""" _sfields_ = [('ra', ctypes.c_char_p), # receiver address ('ta', ctypes.c_char_p), # transmitter address ('bssid', ctypes.c_char_p), # basic service set identifier ('frag_num', ctypes.c_uint), # fragment number ('seq_num', ctypes.c_uint), # sequence number ('timestamp', ctypes.c_uint64), # timestamp ('interval', ctypes.c_uint), # interval ('tagged_params', list)] # tagged parameters # Wireshark syntax conjugates of fields in object (subfield shark) _s_shark_ = {'wlan.ta': 'ta', 'wlan.ra': 'ra', 'wlan.bssid': 'bssid', 'wlan.frag': 'frag_num', 'wlan.seq': 'seq_num', 'wlan_mgt.fixed.timestamp': 'timestamp', 'wlan_mgt.fixed.beacon': 'interval', 'wlan_mgt.tagged.all': 'tagged_params'} _sfields_ += Management._capabilities_ _s_shark_.update(Management._scapabilities_) def __init__(self, frame, no_rtap=False): """ """ Management.__init__(self, frame, no_rtap) idx = 0 self.ta = self.ra = self.bssid = None self.seq_num = self.frag_num = None self.timestamp = self.interval = None # fixed capability fields self.ess = self.ibss = None self.privacy = None self.priv = self.short_pre = self.pbcc = self.chan_agility = None self.spec_man = self.short_slot = self.apsd = self.radio_meas = None self.dss_ofdm = self.del_back = self.imm_back = None seq_idx, _, _, self.ta, self.ra, _, self.bssid = self.strip_mac_addrs() idx = seq_idx self.seq_num, self.frag_num = self.strip_seq_cntrl(idx) idx += 2 payload = self._packet[idx:idx + 12] timestamp, interval, fixed_capabils = self.strip_fixed_params(payload) if all([timestamp, interval, fixed_capabils]): self.timestamp = timestamp self.interval = interval self.set_fixed_capabils(fixed_capabils) idx += 12 else: logging.error("failed to parse fixed parameters") return if idx < len(self._packet): self._raw_tagged_params = self._packet[idx:] is_out_bound, tagged_params = self.parse_tagged_params(self._raw_tagged_params) if len(tagged_params): self.tagged_params = tagged_params if is_out_bound: logging.error("tag_len header not matched with raw byte counts") class ProbeReq(Management): """Probe Request (type: 0, subtype:4)""" _sfields_ = [('ra', ctypes.c_char_p), # receiver address ('ta', ctypes.c_char_p), # transmitter address ('bssid', ctypes.c_char_p), # basic service set identifier ('frag_num', ctypes.c_uint), # fragment number ('seq_num', ctypes.c_uint), # sequence number ('tagged_params', list)] # tagged parameters _s_shark_ = {'wlan.ra': 'ra', 'wlan.ta': 'ta', 'wlan.bssid': 'bssid', 'wlan.frag': 'frag_num', 'wlan.seq': 'seq_num', 'wlan_mgt.tagged.all': 'tagged_params'} def __init__(self, frame, no_rtap=False): """ """ Management.__init__(self, frame, no_rtap) idx = 0 self.ta = self.ra = self.bssid = None self.seq_num = self.frag_num = None seq_idx, _, _, self.ta, self.ra, _, self.bssid = self.strip_mac_addrs() idx = seq_idx self.seq_num, self.frag_num = self.strip_seq_cntrl(idx) idx += 2 if idx < len(self._packet): self._raw_tagged_params = self._packet[idx:] is_out_bound, tagged_params = self.parse_tagged_params(self._raw_tagged_params) if len(tagged_params): self.tagged_params = tagged_params if is_out_bound: logging.error("tag_len header not matched with raw byte counts") class Beacon(Management): """Beacon (type: 0, subtype: 0)""" _sfields_ = [('ra', ctypes.c_char_p), # receiver address ('ta', ctypes.c_char_p), # transmitter address ('bssid', ctypes.c_char_p), # basic service set identifier ('frag_num', ctypes.c_uint), # fragment number ('seq_num', ctypes.c_uint), # sequence number ('timestamp', ctypes.c_uint64), # timestamp ('interval', ctypes.c_uint), # interval ('tagged_params', list)] # tagged parameters # Wireshark syntax conjugates of fields in object (subfield shark) _s_shark_ = {'wlan.ta': 'ta', 'wlan.ra': 'ra', 'wlan.bssid': 'bssid', 'wlan.frag': 'frag_num', 'wlan.seq': 'seq_num', 'wlan_mgt.fixed.timestamp': 'timestamp', 'wlan_mgt.fixed.beacon': 'interval', 'wlan_mgt.tagged.all': 'tagged_params'} _sfields_ += Management._capabilities_ _s_shark_.update(Management._scapabilities_) def __init__(self, frame, no_rtap=False): """Constructor method. :frame: ctypes.Structure """ Management.__init__(self, frame, no_rtap) idx = 0 self.timestamp = self.interval = None self.ta = self.ra = self.bssid = None self.seq_num = self.frag_num = None # fixed capability fields self.ess = self.ibss = None self.privacy = None self.priv = self.short_preamble = self.pbcc = self.chan_agility = None self.spec_man = self.short_slot = self.apsd = self.radio_meas = None self.dss_ofdm = self.del_back = self.imm_back = None seq_idx, _, _, self.ta, self.ra, _, self.bssid = self.strip_mac_addrs() idx = seq_idx self.seq_num, self.frag_num = self.strip_seq_cntrl(idx) idx += 2 payload = self._packet[idx:idx + 12] timestamp, interval, fixed_capabils = self.strip_fixed_params(payload) if all([timestamp, interval, fixed_capabils]): self.timestamp = timestamp self.interval = interval self.set_fixed_capabils(fixed_capabils) idx += 12 else: logging.warning("failed to parse fixed parameters") return if idx < len(self._packet): self._raw_tagged_params = self._packet[idx:] is_out_bound, tagged_params = self.parse_tagged_params(self._raw_tagged_params) if len(tagged_params): self.tagged_params = tagged_params if is_out_bound: logging.warning("tag_len header not matched with raw byte counts") def __str__(self): frame = "%s from %s (tstamp: %d, interval: %d)" frame = frame % (self.name, self.bssid, self.timestamp, self.interval) return frame class Control(Wifi): """Control Frames (type: 1)""" def __init__(self, frame, no_rtap=False): """Constructor method. :frame: ctypes.Structure """ Wifi.__init__(self, frame, no_rtap) def __str__(self): return self.name class RTS(Control): """Request to Send Frame (type: 1, subtype: 1)""" _sfields_ = [('ta', ctypes.c_char_p), # transmitter address ('ra', ctypes.c_char_p)] # receiver address # Wireshark syntax conjugates of fields in object (subfield shark) _s_shark_ = {'wlan.ta': 'ta', 'wlan.ra': 'ra'} def __init__(self, frame, no_rtap=False): """Constructor method. :frame: ctypes.Structure """ Control.__init__(self, frame, no_rtap) (ra_mac, ta_mac) = struct.unpack('!6s6s', self._packet[4:16]) self.ra = Wifi.get_mac_addr(ra_mac) self.ta = Wifi.get_mac_addr(ta_mac) def __str__(self): frame = '%s from %s to %s (duration: %d us)' frame = frame % (self.name, self.ta, self.ra, self.duration) return frame class CTS(Control): """Clear to Send Frame (type: 1, subtype: 2)""" _sfields_ = [('ra', ctypes.c_char_p)] # receiver address -> wlan.ra # Wireshark syntax conjugates of fields in object (subfield shark) _s_shark_ = {'wlan.ra': 'ra'} def __init__(self, frame, no_rtap=False): """Constructor method. :frame: ctypes.Structure """ Control.__init__(self, frame, no_rtap) ra_mac = struct.unpack('!6s', self._packet[4:10])[0] self.ra = Wifi.get_mac_addr(ra_mac) def __str__(self): frame = '%s to %s (duration: %d us)' frame = frame % (self.name, self.ra, self.duration) return frame class BACK(Control): _sfields_ = [('ra', ctypes.c_char_p), # receiver address ('ta', ctypes.c_char_p), # transmitter address ('ackpolicy', ctypes.c_bool), # acknowledgement policy ('multitid', ctypes.c_bool), # multiple traffic identifier ('ssc_frag', ctypes.c_uint), # starting sequence number fragment ('ssc_seq', ctypes.c_uint), # starting sequence number ('bitmap_str', ctypes.c_char_p), # bitmap string -> in wlan.ba.bm ('acked_seqs', list)] # acknowledged strings -> in wlan.ba.bm and wlan_mgt.fixed.ssc.sequence # Wireshark syntax conjugates of fields in object (subfield shark) _s_shark_ = {'wlan.ra': 'ra', 'wlan.ta': 'ta', 'wlan.ba.control.ackpolicy': 'ackpolicy', 'wlan.ba.control.multitid': 'multitid', 'wlan_mgt.fixed.ssc.fragment': 'ssc_frag', 'wlan_mgt.ssc.sequence': 'ssc_seq'} """Block Acknowledgement Frame (type: 1, subtype: 9)""" def __init__(self, frame, no_rtap=False): """Constructor method. :frame: ctypes.Structure """ Control.__init__(self, frame, no_rtap) (ra_mac, ta_mac) = struct.unpack('!6s6s', self._packet[4:16]) self.ra = self.ta = None self.ackpolicy = self.multitid = None self.ssc_frag = self.ssc_seq = None self.bitmap_str = None self.acked_seqs = [] self.ra = Wifi.get_mac_addr(ra_mac) self.ta = Wifi.get_mac_addr(ta_mac) idx = 16 payload = self._packet[idx:idx + 2] self.ackpolicy, self.multitid = BACK.strip_cntrl(payload) idx += 2 payload = self._packet[idx:idx + 2] self.ssc_seq, self.ssc_frag = BACK.strip_ssc(payload) idx += 2 payload = self._packet[idx:idx + 8] self.bitmap_str = BACK.strip_bitmap_str(payload) idx += 8 self.acked_seqs = BACK.extract_acked_seqs(self.bitmap_str, self.ssc_seq) def get_shark_field(self, fields): """ :fields: str[] """ out = super(BACK, self).get_shark_field(fields) out.update({'acked_seqs': self.acked_seqs, 'bitmap_str': self.bitmap_str}) return out @staticmethod def strip_cntrl(payload): """strip(2 byte) wlan.ba.control :payload: ctypes.structure :return: int multitid (tid: traffic indicator) :return: int ackpolicy """ cntrl = struct.unpack('H', payload)[0] cntrl_bits = format(cntrl, '016b')[::-1] ackpolicy = int(cntrl_bits[0]) multitid = int(cntrl_bits[1]) return ackpolicy, multitid @staticmethod def strip_ssc(payload): """strip(2 byte) wlan_mgt.fixed.ssc :payload: ctypes.structure :return: int ssc_seq (starting sequence control sequence) :return: int ssc_frag (starting sequence control fragment number) """ ssc = struct.unpack('H', payload)[0] ssc_seq = ssc >> 4 ssc_frag = ssc & 0x000f return ssc_seq, ssc_frag @staticmethod def strip_bitmap_str(payload): """strip(8 byte) wlan.ba.bm :payload: ctypes.structure :return: str bitmap """ bitmap = struct.unpack('BBBBBBBB', payload) bitmap_str = '' for elem in bitmap: bitmap_str += format(elem, '08b')[::-1] return bitmap_str @staticmethod def extract_acked_seqs(bitmap, ssc_seq): """extracts acknowledged sequences from bitmap and starting sequence number. :bitmap: str :ssc_seq: int :return: int[] acknowledged sequence numbers """ acked_seqs = [] for idx, val in enumerate(bitmap): if int(val) == 1: seq = (ssc_seq + idx) % 4096 acked_seqs.append(seq) return acked_seqs def __str__(self): frame = '%s from %s to %s (starting seq: %d, num_acked: %d)' frame = frame % (self.name, self.ta, self.ra, self.ssc_seq, len(self.acked_seqs)) return frame class Unknown(Wifi): """ un-identified packet """ def __init__(self, frame, no_rtap): Wifi.__init__(self, frame, no_rtap) self.name = "Unkown" pypcapfile-master/pcapfile/protocols/network/000077500000000000000000000000001335744303000220055ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/network/__init__.py000066400000000000000000000000001335744303000241040ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/network/ip.py000066400000000000000000000101301335744303000227620ustar00rootroot00000000000000""" IP protocol definitions. """ import ctypes import struct class IP(ctypes.Structure): """ Represents an IP packet. """ _fields_ = [('v', ctypes.c_ushort), # version ('hl', ctypes.c_ushort), # internet header length ('tos', ctypes.c_ubyte), # type of service ('len', ctypes.c_ushort), # total length ('id', ctypes.c_ushort), # IPID ('flags', ctypes.c_ushort, 3), # flags ('off', ctypes.c_ushort, 13), # fragmentation offset ('ttl', ctypes.c_ubyte), # TTL ('p', ctypes.c_ubyte), # protocol ('sum', ctypes.c_ushort), # checksum ('src', ctypes.c_ulong), # source address ('dst', ctypes.c_ulong), # destination address ('pad', ctypes.c_char_p)] # padding bytes def __init__(self, packet, layers=0): super(IP, self).__init__() # parse the required header first, deal with options later magic = struct.unpack('!B', packet[0:1])[0] assert ((magic >> 4) == 4 and (magic & 0x0f) > 4), 'not an IPv4 packet.' fields = struct.unpack('!BBHHHBBHII', packet[:20]) self.v = fields[0] >> 4 self.hl = fields[0] & 0x0f self.tos = fields[1] self.len = fields[2] self.id = fields[3] self.flags = fields[4] >> 13 self.off = fields[4] & 0x1fff self.ttl = fields[5] self.p = fields[6] self.sum = fields[7] self.src = fields[8] self.dst = fields[9] if self.hl > 5: payload_start = self.hl * 4 self.opt = packet[0x14:payload_start] self.payload = packet[payload_start:] self.opt_parsed = parse_options(self.opt) else: self.opt = b'' self.payload = packet[0x14:] self.opt_parsed = {} self.pad = b'\x00' if layers: self.load_transport(layers) def load_transport(self, layers=1): if layers: ctor = payload_type(self.p)[0] if ctor: ctor = ctor payload = self.payload self.payload = ctor(payload, layers - 1) else: pass def __str__(self): packet = 'ipv4 packet from %s to %s carrying %d bytes' packet = packet % (self.src, self.dst, len(self.payload)) return packet def parse_ipv4(address): """ Given a raw IPv4 address (i.e. as an unsigned integer), return it in dotted quad notation. """ raw = struct.pack('I', address) octets = struct.unpack('BBBB', raw)[::-1] ipv4 = b'.'.join([('%d' % o).encode('ascii') for o in bytearray(octets)]) return ipv4 def strip_ip(packet): """ Remove the IP packet layer, yielding the transport layer. """ if not isinstance(packet, IP): packet = IP(packet) payload = packet.payload return payload def __call__(packet): return IP(packet) def payload_type(protocol): if protocol == 0x11: from pcapfile.protocols.transport.udp import UDP return (UDP, 'UDP') elif protocol == 0x06: from pcapfile.protocols.transport.tcp import TCP return (TCP, 'TCP') else: return (None, 'unknown') def parse_options(opt_bytes): opts = {} i = 0 l = len(opt_bytes) # unprocessed length while l: opt_type = opt_bytes[i] if opt_type == 0: # end break if opt_type == 1: # NOP i += 1 l -= 1 continue if l < 2: break # invalid opt_len = opt_bytes[i + 1] if opt_len < 2 or opt_len > l: break # invalid # Custom options parsing goes here if opt_type == 0x55: if opt_len < 1 + 1 + 2 + 4 + 8: break # invalid _, _, _, _, uat = struct.unpack('!BBHIQ', opt_bytes[:16]) opts['uat'] = uat i += opt_len l -= opt_len return opts pypcapfile-master/pcapfile/protocols/transport/000077500000000000000000000000001335744303000223505ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/transport/__init__.py000066400000000000000000000000001335744303000244470ustar00rootroot00000000000000pypcapfile-master/pcapfile/protocols/transport/tcp.py000066400000000000000000000045561335744303000235220ustar00rootroot00000000000000""" TCP transport definition """ import ctypes import struct class TCP(ctypes.Structure): """ Represents a TCP packet """ _fields_ = [('src_port', ctypes.c_ushort), # source port ('dst_port', ctypes.c_ushort), # destination port ('seqnum', ctypes.c_uint), # sequence number ('acknum', ctypes.c_uint), # acknowledgment number ('data_offset', ctypes.c_uint), # data offset in bytes ('urg', ctypes.c_bool), # URG ('ack', ctypes.c_bool), # ACK ('psh', ctypes.c_bool), # PSH ('rst', ctypes.c_bool), # RST ('syn', ctypes.c_bool), # SYN ('fin', ctypes.c_bool), # FIN ('win', ctypes.c_ushort), # window size ('sum', ctypes.c_ushort)] # checksum tcp_min_header_size = 20 def __init__(self, packet, layers=0): super(TCP, self).__init__() fields = struct.unpack("!HHIIBBHHH", packet[:self.tcp_min_header_size]) self.src_port = fields[0] self.dst_port = fields[1] self.seqnum = fields[2] self.acknum = fields[3] self.data_offset = 4 * (fields[4] >> 4) self.urg = fields[5] & 32 self.ack = fields[5] & 16 self.psh = fields[5] & 8 self.rst = fields[5] & 4 self.syn = fields[5] & 2 self.fin = fields[5] & 1 self.win = fields[6] self.sum = fields[7] # urg_offset = 4 * fields[8] # rarely used if self.data_offset < 20: self.opt = b'' self.payload = b'' else: self.opt = packet[20:self.data_offset] self.payload = packet[self.data_offset:] def __str__(self): packet = 'tcp %s packet from port %d to port %d carrying %d bytes' str_flags = '' if self.syn: str_flags += 'S' if self.ack: str_flags += 'A' if self.rst: str_flags += 'R' if self.fin: str_flags += 'F' if self.urg: str_flags += 'U' packet = packet % (str_flags, self.src_port, self.dst_port, len(self.payload)) return packet def __len__(self): return max(self.data_offset, self.tcp_min_header_size) + len(self.payload) pypcapfile-master/pcapfile/protocols/transport/udp.py000066400000000000000000000021301335744303000235060ustar00rootroot00000000000000""" UDP transport definition """ import ctypes import struct class UDP(ctypes.Structure): """ Represents a UDP packet """ _fields_ = [('src_port', ctypes.c_ushort), # source port ('dst_port', ctypes.c_ushort), # destination port ('len', ctypes.c_ushort), # length of header and data ('sum', ctypes.c_ushort), # checksum ('payload', ctypes.c_char_p)] # packet payload udp_header_size = 8 def __init__(self, packet, layers=0): super(UDP, self).__init__() fields = struct.unpack("!HHHH", packet[:self.udp_header_size]) self.src_port = fields[0] self.dst_port = fields[1] self.len = fields[2] self.sum = fields[3] self.payload = ctypes.c_char_p(packet[self.udp_header_size:]) def __str__(self): packet = 'udp packet from port %d to port %d carrying %d bytes' packet = packet % (self.src_port, self.dst_port, len(self.payload)) return packet def __len__(self): return self.udp_header_size + len(self.payload) pypcapfile-master/pcapfile/savefile.py000066400000000000000000000171401335744303000204430ustar00rootroot00000000000000# pypcapfile.savefile.py """ Core functionality for reading and parsing libpcap savefiles. This contains the core classes pcap_packet and pcap_savefile, as well as the core function load_savefile. """ import ctypes import struct import sys import pcapfile.linklayer as linklayer from pcapfile.structs import __pcap_header__, pcap_packet from pcapfile import InvalidEncoding, UnknownMagicNumber, InvalidHeader VERBOSE = False _MAGIC_NUMBER = 0xa1b2c3d4 _MAGIC_NUMBER_NS = 0xa1b23c4d def __TRACE__(msg, args=None): if VERBOSE: if args: print(msg.format(*args)) else: print(msg) def validate_packet(pkt): # TODO: extended validation if pkt is None: return False return True class pcap_savefile(object): """ Represents a libpcap savefile. The packets member is a list of pcap_packet instances. The 'valid' member will be None for an uninitialised instance, False if the initial validation fails, or True if the instance has been successfully set up and the file has been parsed. """ def __init__(self, header, packets=None): if not packets: packets = [] self.header = header self.packets = packets self.valid = None self.byteorder = sys.byteorder if not self.__validate__(): self.valid = False else: self.valid = True assert self.valid, 'Invalid savefile.' def __validate__(self): assert __validate_header__(self.header), "Invalid header." if not __validate_header__(self.header): return False # Validate the packets unless they are to be loaded lazily. if isinstance(self.packets, list): if len(self.packets): valid_packet = [validate_packet(pkt) for pkt in self.packets] assert False not in valid_packet, 'Invalid packets in savefile.' if False in valid_packet: return False return True def __repr__(self): string = '%s-endian capture file version %d.%d\n' string += '%ssecond time resolution\n' string += 'snapshot length: %d\n' string += 'linklayer type: %s\nnumber of packets: %d\n' return string % (self.header.byteorder, self.header.major, self.header.minor, "nano" if self.header.ns_resolution else "micro", self.header.snaplen, linklayer.lookup(self.header.ll_type), len(self.packets)) def __length__(self): return len(self.packets) def _load_savefile_header(file_h): """ Load and validate the header of a pcap file. """ try: raw_savefile_header = file_h.read(24) except UnicodeDecodeError: print("\nMake sure the input file is opened in read binary, 'rb'\n") raise InvalidEncoding("Could not read file; it might not be opened in binary mode.") # in case the capture file is not the same endianness as ours, we have to # use the correct byte order for the file header if raw_savefile_header[:4] in [struct.pack(">I", _MAGIC_NUMBER), struct.pack(">I", _MAGIC_NUMBER_NS)]: byte_order = b'big' unpacked = struct.unpack('>IhhIIII', raw_savefile_header) elif raw_savefile_header[:4] in [struct.pack("IIII', raw_packet_header) else: packet_header = struct.unpack(' 0: layers -= 1 raw_packet = linklayer.clookup(hdrp[0].ll_type)(raw_packet_data, layers=layers) else: raw_packet = raw_packet_data packet = pcap_packet(hdrp, timestamp, timestamp_us, capture_len, packet_len, raw_packet) return packet pypcapfile-master/pcapfile/structs.py000066400000000000000000000045071335744303000203570ustar00rootroot00000000000000""" Common structs for the package. """ from __future__ import division import ctypes class __pcap_header__(ctypes.Structure): """ C-struct representation of a savefile header. See __validate_header__ for validation. """ _fields_ = [('magic', ctypes.c_uint), # file magic number ('major', ctypes.c_ushort), # major version number ('minor', ctypes.c_ushort), # minor version number ('tz_off', ctypes.c_uint), # timezone offset ('ts_acc', ctypes.c_uint), # timestamp accuracy ('snaplen', ctypes.c_uint), # snapshot length ('ll_type', ctypes.c_uint), # link layer header type ('byteorder', ctypes.c_char_p), # byte order specifier ('ns_resolution', ctypes.c_bool)] # nanosecond resolution class pcap_packet(ctypes.Structure): """ ctypes Structure representation of a packet. The header field is a pointer to the header of the savefile the packet came from to provide context. It can be accessed with header[0]. By default, the raw packet is stored in a string of hexadecimal-encoded bytes as the packet field. The raw() method will return the raw binary packet. """ _fields_ = [('header', ctypes.POINTER(__pcap_header__)), ('timestamp', ctypes.c_uint), ('timestamp_us', ctypes.c_uint), ('capture_len', ctypes.c_uint), ('packet_len', ctypes.c_uint)] packet = None def __init__(self, header, timestamp, timestamp_us, capture_len, packet_len, packet): super(pcap_packet, self).__init__() self.header = header self.timestamp = timestamp self.timestamp_us = timestamp_us self.capture_len = capture_len self.packet_len = packet_len self.packet = packet def raw(self): """ Return the raw binary data from the packet. """ return self.packet def __repr__(self): if isinstance(self.packet, str): try: return self.raw() except TypeError: return str(self.packet) else: return str(self.packet) @property def timestamp_ms(self): return self.timestamp_us / 1000 pypcapfile-master/pcapfile/test/000077500000000000000000000000001335744303000172475ustar00rootroot00000000000000pypcapfile-master/pcapfile/test/__init__.py000066400000000000000000000000001335744303000213460ustar00rootroot00000000000000pypcapfile-master/pcapfile/test/__main__.py000066400000000000000000000016451335744303000213470ustar00rootroot00000000000000#!/usr/bin/env python """ This is the front end to the pcapfile test SUITE. """ import unittest import sys from pcapfile.test.linklayer_test import TestCase as LinklayerTest from pcapfile.test.savefile_test import TestCase as SavefileTest from pcapfile.test.protocols_linklayer_ethernet import TestCase as EthernetTest from pcapfile.test.protocols_linklayer_wifi import TestCase as WifiTest from pcapfile.test.protocols_network_ip import TestCase as IpTest from pcapfile.test.protocols_transport_tcp import TestCase as TcpTest if __name__ == '__main__': TEST_CLASSES = [SavefileTest, LinklayerTest, EthernetTest, WifiTest, IpTest, TcpTest] SUITE = unittest.TestSuite() LOADER = unittest.TestLoader() for test_class in TEST_CLASSES: SUITE.addTests(LOADER.loadTestsFromTestCase(test_class)) result = unittest.TextTestRunner(verbosity=2).run(SUITE) if not result.wasSuccessful(): sys.exit(1) pypcapfile-master/pcapfile/test/fixture.py000066400000000000000000000334351335744303000213170ustar00rootroot00000000000000""" Test fixtures for the pypcapfile test suite. """ TESTPCAP2 = b""" UydceGQ0XHhjM1x4YjJceGExXHgwMlx4MDBceDA0XHgwMFx4MDBceDAwXHgwMFx4MDBceDAwXHgw MFx4MDBceDAwXHgwMFx4MDFceDAwXHgwMFx4MDFceDAwXHgwMFx4MDB4XHhiM1x4MWFQXHg5MD5c eDAwXHgwME5ceDAwXHgwMFx4MDBOXHgwMFx4MDBceDAwXHhjMD9ceDBlXHgxMVx4MWNceGMwXHgw MCZceGIwXHhmNFx4ZmNceGI4XHgwOFx4MDBFXHgwMFx4MDBAXHhiY0hAXHgwMEBceDA2XHhjOVx4 YTNceGMwXHhhOFx4MDFceDE2Mlx4MTJceGMwXHhmYlx4ZDU6XHgwMFBFYVx4ZTlceGIwXHgwMFx4 MDBceDAwXHgwMFx4YjBceDAyXHhmZlx4ZmZceGM0XHhkNlx4MDBceDAwXHgwMlx4MDRceDA1XHhi NFx4MDFceDAzXHgwM1x4MDFceDAxXHgwMVx4MDhcblx4MTZceGVlXHhhMVx4ZDNceDAwXHgwMFx4 MDBceDAwXHgwNFx4MDJceDAwXHgwMHhceGIzXHgxYVBceGZjXHhlMFx4MDBceDAwSlx4MDBceDAw XHgwMEpceDAwXHgwMFx4MDBceDAwJlx4YjBceGY0XHhmY1x4YjhceGMwP1x4MGVceDExXHgxY1x4 YzBceDA4XHgwMEVceDAwXHgwMDxceDAwXHgwMEBceDAwMVx4MDZceDk0XHhmMDJceDEyXHhjMFx4 ZmJceGMwXHhhOFx4MDFceDE2XHgwMFBceGQ1Olx4YTNEXHhlNFx4ZGVFYVx4ZTlceGIxXHhhMFx4 MTJceDE2XHhhMFx4OGFceDk5XHgwMFx4MDBceDAyXHgwNFx4MDVceGI0XHgwNFx4MDJceDA4XG5c eDA2XHhkMVx4YTVceDk2XHgxNlx4ZWVceGExXHhkM1x4MDFceDAzXHgwM1x4MDd4XHhiM1x4MWFQ PFx4ZTFceDAwXHgwMEJceDAwXHgwMFx4MDBCXHgwMFx4MDBceDAwXHhjMD9ceDBlXHgxMVx4MWNc eGMwXHgwMCZceGIwXHhmNFx4ZmNceGI4XHgwOFx4MDBFXHgwMFx4MDA0XHg5OT5AXHgwMEBceDA2 XHhlY1x4YjlceGMwXHhhOFx4MDFceDE2Mlx4MTJceGMwXHhmYlx4ZDU6XHgwMFBFYVx4ZTlceGIx XHhhM0RceGU0XHhkZlx4ODBceDEwXHg4Mlx4MThNXHhjNFx4MDBceDAwXHgwMVx4MDFceDA4XG5c eDE2XHhlZVx4YTFceGZjXHgwNlx4ZDFceGE1XHg5NnhceGIzXHgxYVBceDk4XHhlMlx4MDBceDAw XHgwMFx4MDFceDAwXHgwMDNceDAxXHgwMFx4MDBceGMwP1x4MGVceDExXHgxY1x4YzBceDAwJlx4 YjBceGY0XHhmY1x4YjhceDA4XHgwMEVceDAwXHgwMSVPcEBceDAwQFx4MDY1XHg5N1x4YzBceGE4 XHgwMVx4MTYyXHgxMlx4YzBceGZiXHhkNTpceDAwUEVhXHhlOVx4YjFceGEzRFx4ZTRceGRmXHg4 MFx4MThceDgyXHgxOFx4OTZceGU2XHgwMFx4MDBceDAxXHgwMVx4MDhcblx4MTZceGVlXHhhMVx4 ZmNceDA2XHhkMVx4YTVceDk2R0VUIC8gSFRUUC8xLjBcclxuSG9zdDogd3d3LmR1Y2tkdWNrZ28u Y29tXHJcbkFjY2VwdDogdGV4dC9odG1sLCB0ZXh0L3BsYWluLCB0ZXh0L2NzcywgdGV4dC9zZ21s LCAqLyo7cT0wLjAxXHJcbkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgY29tcHJlc3MsIGJ6aXAyXHJc bkFjY2VwdC1MYW5ndWFnZTogZW5cclxuVXNlci1BZ2VudDogTHlueC8yLjguN3J4XHhiM1x4MWFQ Y1x4ODJceDAxXHgwMEJceDAwXHgwMFx4MDBCXHgwMFx4MDBceDAwXHgwMCZceGIwXHhmNFx4ZmNc eGI4XHhjMD9ceDBlXHgxMVx4MWNceGMwXHgwOFx4MDBFXHgwMFx4MDA0XHhhN1x4MTNAXHgwMDFc eDA2XHhlZFx4ZTQyXHgxMlx4YzBceGZiXHhjMFx4YThceDAxXHgxNlx4MDBQXHhkNTpceGEzRFx4 ZTRceGRmRWFceGVhXHhhMlx4ODBceDEwXHgwMDZceGNlXHhiMVx4MDBceDAwXHgwMVx4MDFceDA4 XG5ceDA2XHhkMVx4YTVceDlhXHgxNlx4ZWVceGExXHhmY3hceGIzXHgxYVBceGUwXHg5Zlx4MDFc eDAwXHgwMFx4MDFceDAwXHgwMFx4ZWVceDAxXHgwMFx4MDBceDAwJlx4YjBceGY0XHhmY1x4Yjhc eGMwP1x4MGVceDExXHgxY1x4YzBceDA4XHgwMEVceDAwXHgwMVx4ZTBceGE3XHgxNEBceDAwMVx4 MDZceGVjNzJceDEyXHhjMFx4ZmJceGMwXHhhOFx4MDFceDE2XHgwMFBceGQ1Olx4YTNEXHhlNFx4 ZGZFYVx4ZWFceGEyXHg4MFx4MThceDAwNkNceGE2XHgwMFx4MDBceDAxXHgwMVx4MDhcblx4MDZc eGQxXHhhNVx4OWFceDE2XHhlZVx4YTFceGZjSFRUUC8xLjEgMzAxIE1vdmVkIFBlcm1hbmVudGx5 XHJcblNlcnZlcjogbmdpbnhcclxuRGF0ZTogVGh1LCAwMiBBdWcgMjAxMiAxNzowNjowMCBHTVRc clxuQ29udGVudC1UeXBlOiB0ZXh0L2h0bWxcclxuQ29udGVudC1MZW5ndGg6IDE3OFxyXG5Db25u ZWN0aW9uOiBjbG9zZVxyXG5Mb2NhdGlvbjogaHR0cDovL2R1Y2tkdWNrZ28uY29tL1xyXG5FeHBp cmVzeFx4YjNceDFhUFx4ZTNceDlmXHgwMVx4MDBCXHgwMFx4MDBceDAwQlx4MDBceDAwXHgwMFx4 MDAmXHhiMFx4ZjRceGZjXHhiOFx4YzA/XHgwZVx4MTFceDFjXHhjMFx4MDhceDAwRVx4MDBceDAw NFx4YTdceDE1QFx4MDAxXHgwNlx4ZWRceGUyMlx4MTJceGMwXHhmYlx4YzBceGE4XHgwMVx4MTZc eDAwUFx4ZDU6XHhhM0RceGU2XHg4YkVhXHhlYVx4YTJceDgwXHgxMVx4MDA2XHhjZFx4MDRceDAw XHgwMFx4MDFceDAxXHgwOFxuXHgwNlx4ZDFceGE1XHg5YVx4MTZceGVlXHhhMVx4ZmN4XHhiM1x4 MWFQXHgwYlx4YTBceDAxXHgwMEJceDAwXHgwMFx4MDBCXHgwMFx4MDBceDAwXHhjMD9ceDBlXHgx MVx4MWNceGMwXHgwMCZceGIwXHhmNFx4ZmNceGI4XHgwOFx4MDBFXHgwMFx4MDA0XHhmZThAXHgw MEBceDA2XHg4N1x4YmZceGMwXHhhOFx4MDFceDE2Mlx4MTJceGMwXHhmYlx4ZDU6XHgwMFBFYVx4 ZWFceGEyXHhhM0RceGU2XHg4Ylx4ODBceDEwXHg4MUJLXHhjOVx4MDBceDAwXHgwMVx4MDFceDA4 XG5ceDE2XHhlZVx4YTIsXHgwNlx4ZDFceGE1XHg5YXhceGIzXHgxYVA1XHhhMFx4MDFceDAwQlx4 MDBceDAwXHgwMEJceDAwXHgwMFx4MDBceGMwP1x4MGVceDExXHgxY1x4YzBceDAwJlx4YjBceGY0 XHhmY1x4YjhceDA4XHgwMEVceDAwXHgwMDRceDAzXG5AXHgwMEBceDA2XHg4Mlx4ZWVceGMwXHhh OFx4MDFceDE2Mlx4MTJceGMwXHhmYlx4ZDU6XHgwMFBFYVx4ZWFceGEyXHhhM0RceGU2XHg4Y1x4 ODBceDEwXHg4MUJLXHhjOFx4MDBceDAwXHgwMVx4MDFceDA4XG5ceDE2XHhlZVx4YTIsXHgwNlx4 ZDFceGE1XHg5YXhceGIzXHgxYVBgXHhhMlx4MDFceDAwQlx4MDBceDAwXHgwMEJceDAwXHgwMFx4 MDBceGMwP1x4MGVceDExXHgxY1x4YzBceDAwJlx4YjBceGY0XHhmY1x4YjhceDA4XHgwMEVceDAw XHgwMDQyXHgwNEBceDAwQFx4MDZTXHhmNFx4YzBceGE4XHgwMVx4MTYyXHgxMlx4YzBceGZiXHhk NTpceDAwUEVhXHhlYVx4YTJceGEzRFx4ZTZceDhjXHg4MFx4MTFceDgyXHgxOEpceGYxXHgwMFx4 MDBceDAxXHgwMVx4MDhcblx4MTZceGVlXHhhMixceDA2XHhkMVx4YTVceDlheFx4YjNceDFhUFx4 OTA4XHgwNFx4MDBCXHgwMFx4MDBceDAwQlx4MDBceDAwXHgwMFx4MDAmXHhiMFx4ZjRceGZjXHhi OFx4YzA/XHgwZVx4MTFceDFjXHhjMFx4MDhceDAwRVx4MDBceDAwNFx4YTdceDE2QFx4MDAxXHgw Nlx4ZWRceGUxMlx4MTJceGMwXHhmYlx4YzBceGE4XHgwMVx4MTZceDAwUFx4ZDU6XHhhM0RceGU2 XHg4Y0VhXHhlYVx4YTNceDgwXHgxMFx4MDA2XHhjY1x4Y2NceDAwXHgwMFx4MDFceDAxXHgwOFxu XHgwNlx4ZDFceGE1XHhhMVx4MTZceGVlXHhhMix6XHhiM1x4MWFQXHhhYVx4YWNceDAxXHgwME5c eDAwXHgwMFx4MDBOXHgwMFx4MDBceDAwXHhjMD9ceDBlXHgxMVx4MWNceGMwXHgwMCZceGIwXHhm NFx4ZmNceGI4XHgwOFx4MDBFXHgwMFx4MDBAXHhkZFJAXHgwMEBceDA2XHhhOFx4OTlceGMwXHhh OFx4MDFceDE2Mlx4MTJceGMwXHhmYlx4ZDU7XHgwMFAgUFx4YjdceGI1XHgwMFx4MDBceDAwXHgw MFx4YjBceDAyXHhmZlx4ZmZceDEzXHhiZlx4MDBceDAwXHgwMlx4MDRceDA1XHhiNFx4MDFceDAz XHgwM1x4MDFceDAxXHgwMVx4MDhcblx4MTZceGVlXHhhOVx4ZjZceDAwXHgwMFx4MDBceDAwXHgw NFx4MDJceDAwXHgwMHpceGIzXHgxYVBBSlx4MDJceDAwSlx4MDBceDAwXHgwMEpceDAwXHgwMFx4 MDBceDAwJlx4YjBceGY0XHhmY1x4YjhceGMwP1x4MGVceDExXHgxY1x4YzBceDA4XHgwMEVceDAw XHgwMDxceDAwXHgwMEBceDAwMVx4MDZceDk0XHhmMDJceDEyXHhjMFx4ZmJceGMwXHhhOFx4MDFc eDE2XHgwMFBceGQ1O1x4YjhceGY2XHg5MFcgUFx4YjdceGI2XHhhMFx4MTJceDE2XHhhMFx4MTdc eDg2XHgwMFx4MDBceDAyXHgwNFx4MDVceGI0XHgwNFx4MDJceDA4XG5ceDA2XHhkMVx4YTZnXHgx Nlx4ZWVceGE5XHhmNlx4MDFceDAzXHgwM1x4MDd6XHhiM1x4MWFQe0pceDAyXHgwMEJceDAwXHgw MFx4MDBCXHgwMFx4MDBceDAwXHhjMD9ceDBlXHgxMVx4MWNceGMwXHgwMCZceGIwXHhmNFx4ZmNc eGI4XHgwOFx4MDBFXHgwMFx4MDA0VVJAXHgwMEBceDA2MFx4YTZceGMwXHhhOFx4MDFceDE2Mlx4 MTJceGMwXHhmYlx4ZDU7XHgwMFAgUFx4YjdceGI2XHhiOFx4ZjZceDkwWFx4ODBceDEwXHg4Mlx4 MThceGRhXHhiMFx4MDBceDAwXHgwMVx4MDFceDA4XG5ceDE2XHhlZVx4YWFceDFmXHgwNlx4ZDFc eGE2Z3pceGIzXHgxYVBceGRmTlx4MDJceDAwXHgwMFx4MDFceDAwXHgwMC9ceDAxXHgwMFx4MDBc eGMwP1x4MGVceDExXHgxY1x4YzBceDAwJlx4YjBceGY0XHhmY1x4YjhceDA4XHgwMEVceDAwXHgw MSFPW0BceDAwQFx4MDY1XHhiMFx4YzBceGE4XHgwMVx4MTYyXHgxMlx4YzBceGZiXHhkNTtceDAw UCBQXHhiN1x4YjZceGI4XHhmNlx4OTBYXHg4MFx4MThceDgyXHgxOFx4MTJ8XHgwMFx4MDBceDAx XHgwMVx4MDhcblx4MTZceGVlXHhhYSBceDA2XHhkMVx4YTZnR0VUIC8gSFRUUC8xLjBcclxuSG9z dDogZHVja2R1Y2tnby5jb21cclxuQWNjZXB0OiB0ZXh0L2h0bWwsIHRleHQvcGxhaW4sIHRleHQv Y3NzLCB0ZXh0L3NnbWwsICovKjtxPTAuMDFcclxuQWNjZXB0LUVuY29kaW5nOiBnemlwLCBjb21w cmVzcywgYnppcDJcclxuQWNjZXB0LUxhbmd1YWdlOiBlblxyXG5Vc2VyLUFnZW50OiBMeW54LzIu OC43cmVsLjJ6XHhiM1x4MWFQXHhlYVx4ZTBceDAyXHgwMEJceDAwXHgwMFx4MDBCXHgwMFx4MDBc eDAwXHgwMCZceGIwXHhmNFx4ZmNceGI4XHhjMD9ceDBlXHgxMVx4MWNceGMwXHgwOFx4MDBFXHgw MFx4MDA0XHg4OENAXHgwMDFceDA2XHgwY1x4YjUyXHgxMlx4YzBceGZiXHhjMFx4YThceDAxXHgx Nlx4MDBQXHhkNTtceGI4XHhmNlx4OTBYIFBceGI4XHhhM1x4ODBceDEwXHgwMDZbXHhhMVx4MDBc eDAwXHgwMVx4MDFceDA4XG5ceDA2XHhkMVx4YTZrXHgxNlx4ZWVceGFhIHpceGIzXHgxYVBOXHhl ZFx4MDJceDAwXHgwMFx4MDFceDAwXHgwMFx4ZWFceDA1XHgwMFx4MDBceDAwJlx4YjBceGY0XHhm Y1x4YjhceGMwP1x4MGVceDExXHgxY1x4YzBceDA4XHgwMEVceDAwXHgwNVx4ZGNceDg4REBceDAw MVx4MDZceDA3XHgwYzJceDEyXHhjMFx4ZmJceGMwXHhhOFx4MDFceDE2XHgwMFBceGQ1O1x4Yjhc eGY2XHg5MFggUFx4YjhceGEzXHg4MFx4MTBceDAwNlx4YWFceDgwXHgwMFx4MDBceDAxXHgwMVx4 MDhcblx4MDZceGQxXHhhNmxceDE2XHhlZVx4YWEgSFRUUC8xLjEgMjAwIE9LXHJcblNlcnZlcjog bmdpbnhcclxuRGF0ZTogVGh1LCAwMiBBdWcgMjAxMiAxNzowNjowMiBHTVRcclxuQ29udGVudC1U eXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLThcclxuQ29ubmVjdGlvbjogY2xvc2VcclxuRXhw aXJlczogVGh1LCAwMiBBdWcgMjAxMiAxNzowNjowMyBHTVRcclxuQ2FjaGUtQ29udHJvbDogbWF4 LWFnZXpceGIzXHgxYVBceGYxXHhmN1x4MDJceDAwXHgwMFx4MDFceDAwXHgwMFx4ODJceDA0XHgw MFx4MDBceDAwJlx4YjBceGY0XHhmY1x4YjhceGMwP1x4MGVceDExXHgxY1x4YzBceDA4XHgwMEVc eDAwXHgwNHRceDg4RUBceDAwMVx4MDZceDA4czJceDEyXHhjMFx4ZmJceGMwXHhhOFx4MDFceDE2 XHgwMFBceGQ1O1x4YjhceGY2XHg5Nlx4MDAgUFx4YjhceGEzXHg4MFx4MThceDAwNlx4MTJceGI1 XHgwMFx4MDBceDAxXHgwMVx4MDhcblx4MDZceGQxXHhhNmxceDE2XHhlZVx4YWEgLmh0bWwtb25s eSB7XHJcbiAgICAgIGZvbnQtc2l6ZTogMTJweDtcclxuICAgIH1cclxuICAgIGEge1xyXG4gICAg ICB0ZXh0LWRlY29yYXRpb246IG5vbmU7XHJcbiAgICAgIGNvbG9yOiAjMTE2OENDO1xyXG4gICAg fVxyXG4gICAgYTpob3ZlciB7XHJcbiAgICAgIHRleHQtZGVjb3JhdGlvbjogdW5kZXJsaW5lO1xy XG4gICAgfVxyXG4gICAgYTp2aXNpdGVkIHtcclxuICB6XHhiM1x4MWFQXHhmN1x4ZjdceDAyXHgw MEJceDAwXHgwMFx4MDBCXHgwMFx4MDBceDAwXHgwMCZceGIwXHhmNFx4ZmNceGI4XHhjMD9ceDBl XHgxMVx4MWNceGMwXHgwOFx4MDBFXHgwMFx4MDA0XHg4OEZAXHgwMDFceDA2XHgwY1x4YjIyXHgx Mlx4YzBceGZiXHhjMFx4YThceDAxXHgxNlx4MDBQXHhkNTtceGI4XHhmNlx4OWFAIFBceGI4XHhh M1x4ODBceDExXHgwMDZRXHhiN1x4MDBceDAwXHgwMVx4MDFceDA4XG5ceDA2XHhkMVx4YTZsXHgx Nlx4ZWVceGFhIHpceGIzXHgxYVA0XHhmOFx4MDJceDAwQlx4MDBceDAwXHgwMEJceDAwXHgwMFx4 MDBceGMwP1x4MGVceDExXHgxY1x4YzBceDAwJlx4YjBceGY0XHhmY1x4YjhceDA4XHgwMEVceDAw XHgwMDRceGI2WUBceDAwQFx4MDZceGNmXHg5ZVx4YzBceGE4XHgwMVx4MTYyXHgxMlx4YzBceGZi XHhkNTtceDAwUCBQXHhiOFx4YTNceGI4XHhmNlx4OWFAXHg4MFx4MTBceDdmXHhmOFx4ZDFceGNi XHgwMFx4MDBceDAxXHgwMVx4MDhcblx4MTZceGVlXHhhYUpceDA2XHhkMVx4YTZselx4YjNceDFh UG1ceGY4XHgwMlx4MDBCXHgwMFx4MDBceDAwQlx4MDBceDAwXHgwMFx4YzA/XHgwZVx4MTFceDFj XHhjMFx4MDAmXHhiMFx4ZjRceGZjXHhiOFx4MDhceDAwRVx4MDBceDAwNFx4ODVceDAwQFx4MDBA XHgwNlx4MDBceGY4XHhjMFx4YThceDAxXHgxNjJceDEyXHhjMFx4ZmJceGQ1O1x4MDBQIFBceGI4 XHhhM1x4YjhceGY2XHg5YUFceDgwXHgxMFx4N2ZceGY4XHhkMVx4Y2FceDAwXHgwMFx4MDFceDAx XHgwOFxuXHgxNlx4ZWVceGFhSlx4MDZceGQxXHhhNmx6XHhiM1x4MWFQXHhiMFx4ZmNceDAyXHgw MEJceDAwXHgwMFx4MDBCXHgwMFx4MDBceDAwXHhjMD9ceDBlXHgxMVx4MWNceGMwXHgwMCZceGIw XHhmNFx4ZmNceGI4XHgwOFx4MDBFXHgwMFx4MDA0TiZAXHgwMEBceDA2N1x4ZDJceGMwXHhhOFx4 MDFceDE2Mlx4MTJceGMwXHhmYlx4ZDU7XHgwMFAgUFx4YjhceGEzXHhiOFx4ZjZceDlhQVx4ODBc eDExXHg4Mlx4MThceGNmXHhhOFx4MDBceDAwXHgwMVx4MDFceDA4XG5ceDE2XHhlZVx4YWFLXHgw Nlx4ZDFceGE2bHpceGIzXHgxYVBceGM2XHg4Y1x4MDNceDAwQlx4MDBceDAwXHgwMEJceDAwXHgw MFx4MDBceDAwJlx4YjBceGY0XHhmY1x4YjhceGMwP1x4MGVceDExXHgxY1x4YzBceDA4XHgwMEVc eDAwXHgwMDRceDg4R0BceDAwMVx4MDZceDBjXHhiMTJceDEyXHhjMFx4ZmJceGMwXHhhOFx4MDFc eDE2XHgwMFBceGQ1O1x4YjhceGY2XHg5YUEgUFx4YjhceGE0XHg4MFx4MTBceDAwNlFceDg3XHgw MFx4MDBceDAxXHgwMVx4MDhcblx4MDZceGQxXHhhNnBceDE2XHhlZVx4YWFLJwpwMAou """ TESTPCAP3 = b""" gANCVAsAANTDsqECAAQAAAAAAAAAAAAAAQAAAQAAAHizGlCQPgAATgAAAE4AAADAPw4RHMAAJrD0 /LgIAEUAAEC8SEAAQAbJo8CoARYyEsD71ToAUEVh6bAAAAAAsAL//8TWAAACBAW0AQMDAQEBCAoW 7qHTAAAAAAQCAAB4sxpQ/OAAAEoAAABKAAAAACaw9Py4wD8OERzACABFAAA8AABAADEGlPAyEsD7 wKgBFgBQ1TqjROTeRWHpsaASFqCKmQAAAgQFtAQCCAoG0aWWFu6h0wEDAwd4sxpQPOEAAEIAAABC AAAAwD8OERzAACaw9Py4CABFAAA0mT5AAEAG7LnAqAEWMhLA+9U6AFBFYemxo0Tk34AQghhNxAAA AQEIChbuofwG0aWWeLMaUJjiAAAAAQAAMwEAAMA/DhEcwAAmsPT8uAgARQABJU9wQABABjWXwKgB FjISwPvVOgBQRWHpsaNE5N+AGIIYluYAAAEBCAoW7qH8BtGllkdFVCAvIEhUVFAvMS4wDQpIb3N0 OiB3d3cuZHVja2R1Y2tnby5jb20NCkFjY2VwdDogdGV4dC9odG1sLCB0ZXh0L3BsYWluLCB0ZXh0 L2NzcywgdGV4dC9zZ21sLCAqLyo7cT0wLjAxDQpBY2NlcHQtRW5jb2Rpbmc6IGd6aXAsIGNvbXBy ZXNzLCBiemlwMg0KQWNjZXB0LUxhbmd1YWdlOiBlbg0KVXNlci1BZ2VudDogTHlueC8yLjguN3J4 sxpQY4IBAEIAAABCAAAAACaw9Py4wD8OERzACABFAAA0pxNAADEG7eQyEsD7wKgBFgBQ1TqjROTf RWHqooAQADbOsQAAAQEICgbRpZoW7qH8eLMaUOCfAQAAAQAA7gEAAAAmsPT8uMA/DhEcwAgARQAB 4KcUQAAxBuw3MhLA+8CoARYAUNU6o0Tk30Vh6qKAGAA2Q6YAAAEBCAoG0aWaFu6h/EhUVFAvMS4x IDMwMSBNb3ZlZCBQZXJtYW5lbnRseQ0KU2VydmVyOiBuZ2lueA0KRGF0ZTogVGh1LCAwMiBBdWcg MjAxMiAxNzowNjowMCBHTVQNCkNvbnRlbnQtVHlwZTogdGV4dC9odG1sDQpDb250ZW50LUxlbmd0 aDogMTc4DQpDb25uZWN0aW9uOiBjbG9zZQ0KTG9jYXRpb246IGh0dHA6Ly9kdWNrZHVja2dvLmNv bS8NCkV4cGlyZXN4sxpQ458BAEIAAABCAAAAACaw9Py4wD8OERzACABFAAA0pxVAADEG7eIyEsD7 wKgBFgBQ1TqjROaLRWHqooARADbNBAAAAQEICgbRpZoW7qH8eLMaUAugAQBCAAAAQgAAAMA/DhEc wAAmsPT8uAgARQAANP44QABABoe/wKgBFjISwPvVOgBQRWHqoqNE5ouAEIFCS8kAAAEBCAoW7qIs BtGlmnizGlA1oAEAQgAAAEIAAADAPw4RHMAAJrD0/LgIAEUAADQDCkAAQAaC7sCoARYyEsD71ToA UEVh6qKjROaMgBCBQkvIAAABAQgKFu6iLAbRpZp4sxpQYKIBAEIAAABCAAAAwD8OERzAACaw9Py4 CABFAAA0MgRAAEAGU/TAqAEWMhLA+9U6AFBFYeqio0TmjIARghhK8QAAAQEIChbuoiwG0aWaeLMa UJA4BABCAAAAQgAAAAAmsPT8uMA/DhEcwAgARQAANKcWQAAxBu3hMhLA+8CoARYAUNU6o0TmjEVh 6qOAEAA2zMwAAAEBCAoG0aWhFu6iLHqzGlCqrAEATgAAAE4AAADAPw4RHMAAJrD0/LgIAEUAAEDd UkAAQAaomcCoARYyEsD71TsAUCBQt7UAAAAAsAL//xO/AAACBAW0AQMDAQEBCAoW7qn2AAAAAAQC AAB6sxpQQUoCAEoAAABKAAAAACaw9Py4wD8OERzACABFAAA8AABAADEGlPAyEsD7wKgBFgBQ1Tu4 9pBXIFC3tqASFqAXhgAAAgQFtAQCCAoG0aZnFu6p9gEDAwd6sxpQe0oCAEIAAABCAAAAwD8OERzA ACaw9Py4CABFAAA0VVJAAEAGMKbAqAEWMhLA+9U7AFAgULe2uPaQWIAQghjasAAAAQEIChbuqh8G 0aZnerMaUN9OAgAAAQAALwEAAMA/DhEcwAAmsPT8uAgARQABIU9bQABABjWwwKgBFjISwPvVOwBQ IFC3trj2kFiAGIIYEnwAAAEBCAoW7qogBtGmZ0dFVCAvIEhUVFAvMS4wDQpIb3N0OiBkdWNrZHVj a2dvLmNvbQ0KQWNjZXB0OiB0ZXh0L2h0bWwsIHRleHQvcGxhaW4sIHRleHQvY3NzLCB0ZXh0L3Nn bWwsICovKjtxPTAuMDENCkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgY29tcHJlc3MsIGJ6aXAyDQpB Y2NlcHQtTGFuZ3VhZ2U6IGVuDQpVc2VyLUFnZW50OiBMeW54LzIuOC43cmVsLjJ6sxpQ6uACAEIA AABCAAAAACaw9Py4wD8OERzACABFAAA0iENAADEGDLUyEsD7wKgBFgBQ1Tu49pBYIFC4o4AQADZb oQAAAQEICgbRpmsW7qogerMaUE7tAgAAAQAA6gUAAAAmsPT8uMA/DhEcwAgARQAF3IhEQAAxBgcM MhLA+8CoARYAUNU7uPaQWCBQuKOAEAA2qoAAAAEBCAoG0aZsFu6qIEhUVFAvMS4xIDIwMCBPSw0K U2VydmVyOiBuZ2lueA0KRGF0ZTogVGh1LCAwMiBBdWcgMjAxMiAxNzowNjowMiBHTVQNCkNvbnRl bnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PVVURi04DQpDb25uZWN0aW9uOiBjbG9zZQ0KRXhw aXJlczogVGh1LCAwMiBBdWcgMjAxMiAxNzowNjowMyBHTVQNCkNhY2hlLUNvbnRyb2w6IG1heC1h Z2V6sxpQ8fcCAAABAACCBAAAACaw9Py4wD8OERzACABFAAR0iEVAADEGCHMyEsD7wKgBFgBQ1Tu4 9pYAIFC4o4AYADYStQAAAQEICgbRpmwW7qogLmh0bWwtb25seSB7DQogICAgICBmb250LXNpemU6 IDEycHg7DQogICAgfQ0KICAgIGEgew0KICAgICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOw0KICAg ICAgY29sb3I6ICMxMTY4Q0M7DQogICAgfQ0KICAgIGE6aG92ZXIgew0KICAgICAgdGV4dC1kZWNv cmF0aW9uOiB1bmRlcmxpbmU7DQogICAgfQ0KICAgIGE6dmlzaXRlZCB7DQogIHqzGlD39wIAQgAA AEIAAAAAJrD0/LjAPw4RHMAIAEUAADSIRkAAMQYMsjISwPvAqAEWAFDVO7j2mkAgULijgBEANlG3 AAABAQgKBtGmbBbuqiB6sxpQNPgCAEIAAABCAAAAwD8OERzAACaw9Py4CABFAAA0tllAAEAGz57A qAEWMhLA+9U7AFAgULijuPaaQIAQf/jRywAAAQEIChbuqkoG0aZserMaUG34AgBCAAAAQgAAAMA/ DhEcwAAmsPT8uAgARQAANIUAQABABgD4wKgBFjISwPvVOwBQIFC4o7j2mkGAEH/40coAAAEBCAoW 7qpKBtGmbHqzGlCw/AIAQgAAAEIAAADAPw4RHMAAJrD0/LgIAEUAADROJkAAQAY30sCoARYyEsD7 1TsAUCBQuKO49ppBgBGCGM+oAAABAQgKFu6qSwbRpmx6sxpQxowDAEIAAABCAAAAACaw9Py4wD8O ERzACABFAAA0iEdAADEGDLEyEsD7wKgBFgBQ1Tu49ppBIFC4pIAQADZRhwAAAQEICgbRpnAW7qpL cQAu """ pypcapfile-master/pcapfile/test/linklayer_test.py000066400000000000000000000024531335744303000226560ustar00rootroot00000000000000#!/usr/bin/env python """ This is the test case for the savefile. """ import unittest from pcapfile import savefile from pcapfile import linklayer from pcapfile.protocols.linklayer import ethernet class TestCase(unittest.TestCase): """ Validate the linklayer utility functions. """ capfile = None def init_capfile(self, layers=0): """ Initialise capture file. """ self.capfile = savefile.load_savefile(open('test_data/test.pcap', 'r'), layers=layers) @classmethod def setUpClass(cls): """ Print an intro to identify this test suite when running multiple tests. """ print('[+] loading toplevel linklayer utility tests') def test_constructor_lookup(self): """ Ensure the proper validation function is passed from the constructor lookup. """ self.assertEqual(ethernet.Ethernet, linklayer.clookup(1)) def test_lookup(self): """ Test the strings returned by the short lookup functions. """ self.assertEqual('LINKTYPE_ETHERNET', linklayer.lookup(1), 'invalid long name') self.assertEqual('ethernet', linklayer.slookup(1), 'invalid short name') pypcapfile-master/pcapfile/test/protocols_linklayer_ethernet.py000066400000000000000000000034471335744303000256250ustar00rootroot00000000000000#!/usr/bin/env python """ This is the test case for the savefile. """ import binascii import unittest from pcapfile.protocols.linklayer import ethernet # a sample ethernet frame carrying an IPv4 SYN request TEST_PACKET = [b'010203040506ffeeddccbbaa08004500003cc43800003806', b'2898adc22552c0a8022f0050f9dc06511a336489a374a012', b'37641b070000020405960402080a2195430027e3b0900103', b'0306'] TEST_PACKET = binascii.unhexlify(b''.join(TEST_PACKET)) def str_to_ethaddr(x): return binascii.unhexlify(x.replace(':', '')) class TestCase(unittest.TestCase): """ Test case for the Ethernet frame parser. """ @classmethod def setUpClass(cls): """ Print a start message when loading the test suite. """ print('[+] testing ethernet frame decoding...') def test_frame_field(self): """ Verify attributes of Ethernet instance. """ frame = ethernet.Ethernet(TEST_PACKET) self.assertEqual(frame.src, str_to_ethaddr('ff:ee:dd:cc:bb:aa'), 'invalid frame source address') self.assertEqual(frame.dst, str_to_ethaddr('01:02:03:04:05:06'), 'invalid frame destination address') self.assertEqual(frame.type, 0x0800, 'invalid frame type') self.assertTrue(hasattr(frame, 'load_network'), 'missing load_network method') frame.load_network() self.assertTrue(hasattr(frame.payload, 'ttl'), 'load_network fails') def test_frame_load(self): """ Verify the ethernet frames load. """ frame = ethernet.Ethernet(TEST_PACKET) self.assertTrue(isinstance(frame, ethernet.Ethernet), 'invalid ethernet frame!') pypcapfile-master/pcapfile/test/protocols_linklayer_wifi.py000066400000000000000000000435401335744303000247430ustar00rootroot00000000000000#!/usr/bin/env/python """ This is the test case for the savefile. """ import binascii import unittest from pcapfile.protocols.linklayer import wifi # partial data packet, unnecessary tailing payload removed DATA_NON_AMSDU_WDS_PACKET = [b'000026002b4820002364e679000000004000a415400', b'1b30000004400040474000000000000008803480088', b'41d82a01aa8841fc7a0fd3a08614180220387400020', b'00010921400b8aeed73c9b1a8aeec73cf0c0564aaaa', b'030000000998510005dc010140004004a4a5c0a802c', b'9c0a802cad3e3138940d3918980ceb976801883e7ad', b'9f00002101080a007a0bc700f491f13637383930313', b'233343536373839303132333435367738193077b23b', b'36217e3638391031123334353637383930313233343', b'5363738197c21323334353637383822313233343536', b'3738393031323334353637383930313633343536373', b'839303132333435a6a8683f43c1b337b43536773939', b'3031327324353637383930333223363537373839303', b'132a3702602347a3970311233343536373839303132', b'3334752d133839303432337435363738397019a233e', b'f3536373c3930313233343536373839303132333435', b'3637383930313233643536373839b0a136233115b50', b'd3a3930513633303536f738793031326324ce36379c', b'59b2353a33343536373832042132333435363738393', b'0313233343536373839303132333435343738393031', b'323334353637b83d307032437605363738393031323', b'334353737383b30713033342474363cb33531323334', b'3576368835353137333035363738393031323334353', b'6373839303132333437763738393031323301bce1b7', b'3838303132333435363738393031323334353637383', b'9303132333435b6373839303132333437a356f83a70', b'332233b43536373c393031323334353637383930313', b'2333435365f38383031222334053eb3883931313233', b'3435363738393031323334353637383930313233343', b'53e3738393031323334356437383930313233343532'] # entire data packet, all payload included to check number of msdu's in a-msdu DATA_AMSDU_WDS_PACKET = [b'000026002b4820002a80a778000000000000a4154001e100', b'0000440004045300000000000000880348008841fc2a01a6', b'8841fc2a01aa00000000000050020000000000008000b8ae', b'ed73cf08b8aeed73c9b1003caaaa03000000080045000034', b'c4c640004006ef19c0a802cac0a802c91389d3e380ceb976', b'b612736980104988e2cf00000101080a00f47d890279f75c', b'0279b8aeed73cf08b8aeed73c9b1003caaaa030000000800', b'45000034c4c740004006ef18c0a802cac0a802c91389d3e3', b'80ceb976b612c29980104988939f00000101080a00f47d89', b'0279f75c0279b8aeed73cf08b8aeed73c9b1003caaaa0300', b'0000080045000034c4c840004006ef17c0a802cac0a802c9', b'1389d3e380ceb976b61311c980104988446f00000101080a', b'00f47d890279f75c0279b8aeed73cf08b8aeed73c9b1003c', b'aaaa03000000080045000034c4c940004006ef16c0a802ca', b'c0a802c91389d3e380ceb976b6135b5180104988fae60000', b'0101080a00f47d890279f75c0279b8aeed73cf08b8aeed73', b'c9b1003caaaa03000000080045000034c4ca40004006ef15', b'c0a802cac0a802c91389d3e380ceb976b613aa8180104988', b'abb600000101080a00f47d890279f75c0279b8aeed73cf08', b'b8aeed73c9b1003caaaa03000000080045000034c4cb4000', b'4006ef14c0a802cac0a802c91389d3e380ceb976b613ff59', b'8010498856de00000101080a00f47d890279f75c0279b8ae', b'ed73cf08b8aeed73c9b1003caaaa03000000080045000034', b'c4cc40004006ef13c0a802cac0a802c91389d3e380ceb976', b'b6141ba1801049883a9600000101080a00f47d890279f75c'] # entire probe request packet PROBE_REQUEST = [b'00001a002f48000092706a4800000000000c3c144001df0000004008', b'3c008841fc1f99d28841fc5721128841fc57211280f200086f736d61', b'6e63616e01080c1218243048606cdd0b001ca8500102572112e03a2d', b'1aad0917ffffff00000000000000000000000000000000000000007f', b'080400000000000040bf0cb259820feaff0000eaff0000dd2f0050f2', b'04104a00011010490022007fc5100018313131313232323233333333', b'34343431303030303030613530000101dd090010180200001c0000dd', b'1e00904c33ad0917ffffff0000000000000000000000000000000000', b'000000dd070050f208001400'] # entire probe response packet PROBE_RESPONSE = [b'00001a002f4800001f4d634800000000000c3c144001d3000000500', b'83c008086f281daa8c03e0f5ce558c03e0f5ce55820b91653d01804', b'000000640011110011536576656e4e6f6465732d3530472d3336010', b'88c129824b048606c07344742202401172801172c01173001173401', b'173801173c011740011764011e68011e6c011e70011e74011e84011', b'e88011e8c011e002001002302140030140100000fac040100000fac', b'040100000fac0280000b0500004a00002d1aef0917ffffff0000000', b'0000000000000000000000000000000003d16240d00000000000000', b'000000000000000000000000007f080000080000000040bf0cb2598', b'20feaff0000eaff0000c005012a000000c30402020202dd0b001ca8', b'500101f5ba76e02addb00050f204104a0001101044000102103b000', b'10310470010ac79c11cfad8dd17641ce15acd136f0a10210003536b', b'7910230005455231313010240007312e302e302e301042000e41543', b'133353132303330303030311054000800060050f204000110110009', b'536b7920512048756210080002200c103c0001021049000e00372a0', b'001200106ffffffffffff10580022007fc510001894c9f0c1646f4e', b'2465260def16ec2b38303030303537616530000101dd09001018020', b'0001c0000dd180050f2020101840003a4000027a4000042435e0062', b'322f0046057200010000'] # entire beacon packet BEACON_PACKET = [b'00001a002f48000054446f7800000000000ca4154001e80000008000', b'0000ffffffffffff8841fc2a01aa8841fc2a01aa101f0a70a81e0000', b'0000640001050014416972546965735f416972343832305f30314139', b'01088c1298243048606c03016c051302030000000000000000000000', b'00000000000007344652202401172801172c01173001173401173801', b'173c011740011764011e68011e6c011e70011e74011e84011e88011e', b'8c011e00200100c305021e1e1e002a01002d1a6f0817fffffffffeff', b'ffffff1f000001000000000018e6e719003d166c0500000000000000', b'00000000000000000000000000dd180050f2020101860003a4000027', b'a4000042435e0062322f00bf0c3240c33faaff0000aaff0000c00501', b'6a00fcffdd1e002686010300dd000000250400380006019a576938d3', b'0000000000000000dd37001ca8370141697234383230000000000071', b'68733834300000000054575f302e3200000000312e32362e322e3000', b'000000000200000003dd0b001ca85001012a01aae26add5f0050f204', b'104a0001101044000102104700108b3fddc4c80f0c0952b876f9549a', b'f4ca103c0001021049000e00372a0001200106ffffffffffff104900', b'22007fc5100018373732383835383433393337353535333338383739', b'32386630000101'] # entire rts packet RTS_PACKET = [b'00001a002f4800008334e27800000000000ca4154001df000000b400340', b'b8841fc2a01aa8841fc2a01a6'] # entire cts packet CTS_PACKET = [b'00001a002f480000c634e27800000000000ca4154001e7000000c400f80', b'a8841fc2a01a6'] # entire block ack packet BLOCK_ACK_PACKET = [b'00001a002f480000b23fe278000000000030a415400', b'1e8000000940000008841fc2a01a68841fc2a01aa05', b'00902cffffffffff010000'] PROBE_REQ_PACKET = binascii.unhexlify(b''.join(PROBE_REQUEST)) PROBE_RESP_PACKET = binascii.unhexlify(b''.join(PROBE_RESPONSE)) BEACON_PACKET = binascii.unhexlify(b''.join(BEACON_PACKET)) RTS_PACKET = binascii.unhexlify(b''.join(RTS_PACKET)) CTS_PACKET = binascii.unhexlify(b''.join(CTS_PACKET)) BLOCK_ACK_PACKET = binascii.unhexlify(b''.join(BLOCK_ACK_PACKET)) DATA_AMSDU_WDS_PACKET = binascii.unhexlify(b''.join(DATA_AMSDU_WDS_PACKET)) DATA_NON_AMSDU_WDS_PACKET = binascii.unhexlify(b''.join(DATA_NON_AMSDU_WDS_PACKET)) class TestCase(unittest.TestCase): """ Test case for the Wi-Fi frame parser. """ @classmethod def setUpClass(cls): """ Print a start message when loading the test suite. """ print('[+] testing Wi-Fi frame decoding...') def test_rts_packet(self): """ Verify attributes of Request to Sent instance. """ frame = wifi.WIFI(RTS_PACKET) self.assertTrue(isinstance(frame, wifi.RTS), 'invalid RTS frame!') self.assertEqual(frame.radiotap.chan.freq, 5540, 'invalid channel frequency in radiotap headers') self.assertEqual(frame.radiotap.mactime, 2028090499, 'invalid radiotap mactime') self.assertEqual(frame.radiotap.rate, 6.0, 'invalid rate') self.assertEqual(frame.ta, b'88:41:fc:2a:01:a6', 'invalid transmitter address') self.assertEqual(frame.ra, b'88:41:fc:2a:01:aa', 'invalid receiver address') self.assertEqual(frame.duration, 2868, 'invalid duration field') def test_cts_packet(self): """ Verify attributes of Clear to Send Instance. """ frame = wifi.WIFI(CTS_PACKET) self.assertTrue(isinstance(frame, wifi.CTS), 'invalid CTS frame!') self.assertEqual(frame.radiotap.mactime, 2028090566, 'invalid radiotap mactime') self.assertEqual(frame.radiotap.chan.freq, 5540, 'invalid channel frequency in radiotap headers') self.assertEqual(frame.radiotap.rate, 6.0, 'invalid rate') self.assertEqual(frame.ra, b'88:41:fc:2a:01:a6', 'invalid receiver address') self.assertEqual(frame.duration, 2808, 'invalid duration field') def test_block_ack_packet(self): """ Verify attributes of Block Acknowledgement instance. """ frame = wifi.WIFI(BLOCK_ACK_PACKET) self.assertTrue(isinstance(frame, wifi.BACK), 'invalid BLOCK ACK frame!') self.assertEqual(frame.radiotap.mactime, 2028093362, 'invalid radiotap mactime') self.assertEqual(frame.radiotap.chan.freq, 5540, 'invalid channel frequency in radiotap headers') self.assertEqual(frame.ta, b'88:41:fc:2a:01:aa', 'invalid transmitter address') self.assertEqual(frame.ra, b'88:41:fc:2a:01:a6', 'invalid receiver address') self.assertEqual(frame.acked_seqs, list(range(713, 754)), 'invalid sequence numbers in acknowledgement') def test_beacon_packet(self): """ Verify attributes of Beacon instance. """ frame = wifi.WIFI(BEACON_PACKET) self.assertTrue(isinstance(frame, wifi.Beacon), 'invalid Beacon frame!') self.assertEqual(frame.radiotap.mactime, 2020557908, 'invalid radiotap mactime') self.assertEqual(frame.radiotap.chan.freq, 5540, 'invalid channel frequency in radiotap headers') self.assertEqual(frame.ta, b'88:41:fc:2a:01:aa', 'invalid transmitter address') self.assertEqual(frame.ra, b'ff:ff:ff:ff:ff:ff', 'invalid receiver address') self.assertEqual(frame.timestamp, 514355210, 'invalid beacon timestamp') self.assertEqual(frame.seq_num, 497, 'invalid sequence number') def test_probe_req_packet(self): """ Verify attributes of Probe Request instance. """ frame = wifi.WIFI(PROBE_REQ_PACKET) self.assertTrue(isinstance(frame, wifi.ProbeReq), 'invalid Beacon frame!') self.assertEqual(len(frame.tagged_params), 10, 'invalid number of tagged paramters') vendor_ies = frame.get_vendor_ies() self.assertEqual(len(vendor_ies), 5, 'invalid number of vendor ies') ie_type = frame.get_vendor_ies('00-1C-A8', 80) self.assertEqual(len(ie_type), 1, 'invalid number of ies for mac block 00-1C-A8') def test_probe_resp_packet(self): """ Verify attributes of Probe Response instance. """ frame = wifi.WIFI(PROBE_RESP_PACKET) self.assertTrue(isinstance(frame, wifi.ProbeResp), 'invalid Probe Response frame!') self.assertEqual(frame.timestamp, 17596175126, 'invalid timestamp') self.assertEqual(frame.ess, 1, 'invalid ess flag') self.assertEqual(frame.ibss, 0, 'invalid ibss flag') self.assertEqual(frame.priv, 1, 'invalid privacy capability flag') self.assertEqual(frame.short_preamble, 0, 'invalid short preamble flag') self.assertEqual(frame.pbcc, 0, 'invalid pbcc flag') self.assertEqual(frame.chan_agility, 0, 'invalid channel agility flag') self.assertEqual(frame.spec_man, 1, 'invalid spectrum management flag') self.assertEqual(frame.short_slot, 0, 'invalid short slot time flag') self.assertEqual(frame.apsd, 0, 'invalid automatic power save delivery flag') self.assertEqual(frame.dss_ofdm, 0, 'invalid dynamic spec spectrum / ofdm flag') self.assertEqual(frame.del_back, 0, 'invalid delayed block ack flag') self.assertEqual(frame.imm_back, 0, 'invalid immediate block ack flag') self.assertEqual(len(frame.tagged_params), 18, 'invalid number of tagged parameters') vendor_ies = frame.get_vendor_ies() self.assertEqual(len(vendor_ies), 4, 'invalid number of vendor ies') ie_type = frame.get_vendor_ies('00-10-18', 2) self.assertEqual(len(ie_type), 1, 'invalid number of ies for mac block 00-10-18') def test_data_amsdu_wds_packet(self): """ Verify attributes of Data instance with A-MSDU usage and in WDS(Wireless Distribution System) """ frame = wifi.WIFI(DATA_AMSDU_WDS_PACKET) self.assertTrue(isinstance(frame, wifi.QosData), 'invalid QosData frame!') self.assertEqual(frame.radiotap.mactime, 2024243242, 'invalid radiotap mactime') self.assertEqual(frame.radiotap.chan.freq, 5540, 'invalid channel frequency in radiotap headers') self.assertEqual(frame.from_ds, 1, 'invalid flag value in frame control') self.assertEqual(frame.to_ds, 1, 'invalid flag value in frame control') self.assertEqual(frame.amsdupresent, 1, 'invalid a-msdu information') self.assertEqual(frame.ta, b'88:41:fc:2a:01:aa', 'invalid transmitter address') self.assertEqual(frame.ra, b'88:41:fc:2a:01:a6', 'invalid receiver address') self.assertEqual(frame.seq_num, 37, 'invalid sequence number') self.assertEqual(len(frame.payload), 7, 'invalid a-msdu aggregation formed') def test_data_non_amsdu_wds_packet(self): """ Verify attributes of Data instance when A-MSDU is not used in WDS(Wireless Distribution System) """ frame = wifi.WIFI(DATA_NON_AMSDU_WDS_PACKET) self.assertTrue(isinstance(frame, wifi.QosData), 'invalid QosData frame!') self.assertEqual(frame.radiotap.mactime, 2045142051, 'invalid radiotap mactime') self.assertEqual(frame.radiotap.chan.freq, 5540, 'invalid channel frequency in radiotap headers') self.assertEqual(frame.from_ds, 1, 'invalid flag value in frame control') self.assertEqual(frame.to_ds, 1, 'invalid flag value in frame control') self.assertEqual(frame.amsdupresent, 0, 'invalid a-msdu information') self.assertEqual(frame.ta, b'88:41:fc:7a:0f:d3', 'invalid transmitter address') self.assertEqual(frame.ra, b'88:41:d8:2a:01:aa', 'invalid receiver address') self.assertEqual(frame.seq_num, 1859, 'invalid sequence number') self.assertEqual(len(frame.payload), 1, 'invalid a-msdu aggregation formed') pypcapfile-master/pcapfile/test/protocols_network_ip.py000066400000000000000000000034011335744303000241040ustar00rootroot00000000000000#!/usr/bin/env python """ This is the test case for IP. """ import unittest from pcapfile import savefile from pcapfile.protocols.network.ip import IP def str_to_ipaddr(s): octets = s.split('.') if len(octets) != 4: raise ValueError('Invalid IP address string: ' + s) octets = bytearray(map(int, octets)) return (octets[0] << 24) + (octets[1] << 16) + (octets[2] << 8) + octets[3] class TestCase(unittest.TestCase): @classmethod def setUpClass(cls): """ Print a start message when loading the test suite. """ print('[+] testing IP segment decoding...') def assertIp(self, pcap_packet, **kwargs): frame = pcap_packet.packet packet = frame.payload for k, v in kwargs.items(): if hasattr(packet, k): self.assertEqual(getattr(packet, k), v, k) elif hasattr(frame, k): self.assertEqual(getattr(frame, k), v, k) else: raise Exception('Attribute %s not found' % k) def setUp(self): with open('pcapfile/test/test_data/http_conversation.pcap', 'rb') as f: self.packets = savefile.load_savefile(f, layers=2).packets def test_smoke_test(self): for pcap_packet in self.packets: frame = pcap_packet.packet packet = frame.payload self.assertTrue(isinstance(packet, IP)) def test_extensive(self): self.assertIp( self.packets[0], src=str_to_ipaddr('192.168.54.1'), dst=str_to_ipaddr('192.168.54.2')) def test_timestamp_calc(self): for packet in self.packets: self.assertAlmostEqual( packet.timestamp_us, packet.timestamp_ms * 1000 ) pypcapfile-master/pcapfile/test/protocols_transport_tcp.py000066400000000000000000000047611335744303000246370ustar00rootroot00000000000000#!/usr/bin/env python """ This is the test case for TCP. """ import unittest from pcapfile import savefile from pcapfile.protocols.network.ip import IP from pcapfile.protocols.transport.tcp import TCP TEST_PAYLOAD = b'''\ GET /?q=1 HTTP/1.1\r Host: 192.168.54.1:8080\r User-Agent: curl/7.43.0\r Accept: */*\r \r ''' class TestCase(unittest.TestCase): @classmethod def setUpClass(cls): """ Print a start message when loading the test suite. """ print('[+] testing TCP segment decoding...') def assertTcp(self, pcap_packet, **kwargs): frame = pcap_packet.packet packet = frame.payload segment = packet.payload for k, v in kwargs.items(): if hasattr(segment, k): self.assertEqual(getattr(segment, k), v, k) elif hasattr(packet, k): self.assertEqual(getattr(packet, k), v, k) elif hasattr(frame, k): self.assertEqual(getattr(frame, k), v, k) else: raise Exception('Attribute %s not found' % k) def setUp(self): with open('pcapfile/test/test_data/http_conversation.pcap', 'rb') as f: self.packets = savefile.load_savefile(f, layers=3).packets def test_basic_parsing(self): for pcap_packet in self.packets: frame = pcap_packet.packet packet = frame.payload self.assertTrue(isinstance(packet, IP)) segment = packet.payload self.assertTrue(isinstance(segment, TCP)) def test_extensive(self): self.assertTcp(self.packets[0], syn=True, ack=False, fin=False, rst=False, psh=False, seqnum=223930318, win=29200, sum=0xd2f6) self.assertTcp(self.packets[1], syn=True, ack=True, sum=0x18e3) self.assertTcp(self.packets[3], syn=False, ack=True, psh=True, payload=TEST_PAYLOAD) def test_payload(self): self.assertTcp(self.packets[3], syn=False, ack=True, psh=True, payload=TEST_PAYLOAD) def test_empty_payload(self): self.assertTcp(self.packets[0], payload=b'') def test_fin(self): self.assertTcp(self.packets[0], fin=False) self.assertTcp(self.packets[-2], fin=True) def test_len(self): for pcap_packet in self.packets: frame = pcap_packet.packet packet = frame.payload segment = packet.payload self.assertEqual(len(segment), packet.len - len(packet.opt) - 20) pypcapfile-master/pcapfile/test/savefile_test.py000066400000000000000000000110621335744303000224560ustar00rootroot00000000000000#!/usr/bin/env python """ This is the test case for the savefile. """ import os import pickle import tempfile import unittest import base64 import sys import pcapfile.test.fixture as fixture from pcapfile import savefile def create_pcap(): """ Create a capture file from the test fixtures. """ tfile = tempfile.NamedTemporaryFile() if sys.version_info[0] >= 3: # python3 capture = pickle.loads(base64.b64decode(fixture.TESTPCAP3)) else: # python2 unsupported pickle protocol: 3 capture = pickle.loads(fixture.TESTPCAP2.decode('base64')) with open(tfile.name, 'wb') as f: f.write(capture) return tfile class TestCase(unittest.TestCase): """ Test case for the savefile code. """ capfile = None def init_capfile(self, layers=0): """Initialise the capture file.""" tfile = create_pcap() self.capfile = savefile.load_savefile(tfile, layers=layers) tfile.close() if os.path.exists(tfile.name): os.unlink(tfile.name) @classmethod def setUpClass(cls): """ Print an intro to identify this test suite when running multiple tests. """ print('[+] loading basic tests') def setUp(self): """ Set up a default capture file. """ # only need to initialise capfile on the first time, while being able # load it with additional decoding layers. if not self.capfile: self.init_capfile() def test_network_load(self): """ Test that the code that loads network layer packets from the top level works. """ self.init_capfile(layers=2) for packet in self.capfile.packets: for field in ['src', 'dst', 'v', 'hl', 'tos', 'ttl']: ipkt = packet.packet.payload self.assertTrue(hasattr(ipkt, field), 'invalid packet!') def test_frame_load(self): """ Ensure that ethernet frames load from the top level. """ self.init_capfile(layers=1) for packet in self.capfile.packets: for field in ['src', 'dst', 'type', 'payload']: self.assertTrue(hasattr(packet.packet, field), 'invalid frame!') def test_packet_valid(self): """ Make sure raw packets load properly. """ packet = self.capfile.packets[0].raw() self.assertEqual(int(bytearray(packet)[14]), 69, 'invalid packet') for packet in self.capfile.packets: for field in ['capture_len', 'timestamp', 'timestamp_us', 'packet', 'header', 'packet_len']: self.assertTrue(hasattr(packet, field), 'invalid packet!') def test_header_valid(self): """ Test to ensure the header validation code works. """ header = self.capfile.header self.assertEqual(header.major, 2, 'invalid major version!') self.assertEqual(header.minor, 4, 'invalid minor version!') def test_basic_import(self): """ Validate basic parameters of a simple savefile load. """ self.assertTrue(self.capfile.valid, 'invalid capture file') self.assertEqual(len(self.capfile.packets), 23, 'wrong number of packets!') self.assertEqual(self.capfile.__length__(), 23, '__length__ not reporting correct number of packets') def test_lazy_import(self): """ Test the lazy packet parsing against the regular implementation. """ # Load the savefile again, but create an iterator for the # packets instead of reading them all into memory at once. tfile = create_pcap() capfile_gen = savefile.load_savefile(tfile, lazy=True) # Create a list of packets using the iterator. This way the # length can be checked before comparing any content. packets = list(capfile_gen.packets) tfile.close() if os.path.exists(tfile.name): os.unlink(tfile.name) self.assertEqual(len(packets), len(self.capfile.packets), 'lazy parsing gives different number of packets!') # Compare the relevant parts of the packets. fields = ['timestamp', 'timestamp_us', 'capture_len', 'packet_len', 'packet'] for act, ref in zip(packets, capfile_gen.packets): for field in fields: self.assertEqual(getattr(act, field), getattr(ref, field), 'lazy parsing gives different data!') pypcapfile-master/pcapfile/test/test_data/000077500000000000000000000000001335744303000212175ustar00rootroot00000000000000pypcapfile-master/pcapfile/test/test_data/full_frame_ip_tcp.pkt000066400000000000000000000001121335744303000254030ustar00rootroot00000000000000̻E<88(%R/PQ3dt7d !C'㰐pypcapfile-master/pcapfile/test/test_data/http_conversation.pcap000066400000000000000000000106141335744303000256370ustar00rootroot00000000000000òWZZIL{@?66Up |P Xr |W{ZZIL@?cU66Up P|[ XϠq  |g|WRRID|@?66Up |P X[  ||gW]I}@?NJ66Up |P X[  ||gGET /?q=1 HTTP/1.1 Host: 192.168.54.1:8080 User-Agent: curl/7.43.0 Accept: */* WRRIDc@?66Up P|[ X$㷏 |i|W6BBE4e@?? 66P|[ Xπq G |k|W?>>I0d@? 66Up P|[ X$ |l|HTTP/1.1 200 OK Server: nginx/1.11.3 Date: Fri, 02 Sep 2016 17:29:21 GMT Content-Type: text/html Content-Length: 45 Last-Modified: Fri, 02 Sep 2016 17:29:19 GMT Connection: keep-alive ETag: "57c9b6ef-2d" Accept-Ranges: bytes WRRID~@?66Up |P X$[ ||lWIqe@?66Up P|[ X$Y |m| I'm the shortest valid HTML. WZ/RRID@?66Up |P X$[#T ||mWBI@?/66Up1|P X$[# ||mGET /?q=2 HTTP/1.1 Host: 192.168.54.1:8080 User-Agent: curl/7.43.0 Accept: */* W{>>I0f@?+{66Up1P|[# XyG ||HTTP/1.1 200 OK Server: nginx/1.11.3 Date: Fri, 02 Sep 2016 17:29:21 GMT Content-Type: text/html Content-Length: 45 Last-Modified: Fri, 02 Sep 2016 17:29:19 GMT Connection: keep-alive ETag: "57c9b6ef-2d" Accept-Ranges: bytes W Iqg@?,966Up1P|[ Xy㭴 || I'm the shortest valid HTML. W"RRID@?0L66Up1|P Xy[< ||WI@?[66Up/|P Xy[<! }|GET /?q=3 HTTP/1.1 Host: 192.168.54.1:8080 User-Agent: curl/7.43.0 Accept: */* W>>I0h@?66Up/P|[< X΀e |}HTTP/1.1 200 OK Server: nginx/1.11.3 Date: Fri, 02 Sep 2016 17:29:21 GMT Content-Type: text/html Content-Length: 45 Last-Modified: Fri, 02 Sep 2016 17:29:19 GMT Connection: keep-alive ETag: "57c9b6ef-2d" Accept-Ranges: bytes WBIqi@?66Up/P|[( X΀ |} I'm the shortest valid HTML. W^^IP@?66Up/|P X[<| }| [([UWRRID@?66Up/|P X[U }|WA>>I0j@?66Up/P|[< X΀V |}HTTP/1.1 200 OK Server: nginx/1.11.3 Date: Fri, 02 Sep 2016 17:29:21 GMT Content-Type: text/html Content-Length: 45 Last-Modified: Fri, 02 Sep 2016 17:29:19 GMT Connection: keep-alive ETag: "57c9b6ef-2d" Accept-Ranges: bytes W^^IP@?66Up/|P X[U3 }| [<[(W.5I@?\Q66Upuev|P X[UT }#|GET /?q=4 HTTP/1.1 Host: 192.168.54.1:8080 User-Agent: curl/7.43.0 Accept: */* WrR>>I0k@?W66UpuevP|[U X# |}#HTTP/1.1 200 OK Server: nginx/1.11.3 Date: Fri, 02 Sep 2016 17:29:21 GMT Content-Type: text/html Content-Length: 45 Last-Modified: Fri, 02 Sep 2016 17:29:19 GMT Connection: keep-alive ETag: "57c9b6ef-2d" Accept-Ranges: bytes Wh]Iql@?X66UpuevP|[A X#: |}# I'm the shortest valid HTML. WqRRID@?\66Upuev|P X#[n }2|WRRID@?C66Upqz|P X#[n }`|WjRRIDm@??66UpqzP|[n X$ }}`WkRRID@?C66Upqz|P X$[o }t}pypcapfile-master/pcapfile/test/test_data/ip.pkt000066400000000000000000000000241335744303000223430ustar00rootroot00000000000000E@@@ż/%Rpypcapfile-master/pcapfile_info000077500000000000000000000011361335744303000172320ustar00rootroot00000000000000#!/usr/bin/env python """ Command-line utility to dump information about a pcap file. """ import sys from pcapfile import savefile def pcap_info(pcap_file): """ Main function to read and display information about a libpcap savefile. """ with open(pcap_file, 'rb') as f: capfile = savefile.load_savefile(f, verbose=False) if capfile.valid: print(capfile) else: print('Invalid packet capture!') if __name__ == '__main__': try: pcap_info(sys.argv[1]) except Exception: print('Invalid or missing pcap file') sys.exit(1) pypcapfile-master/samples/000077500000000000000000000000001335744303000161515ustar00rootroot00000000000000pypcapfile-master/samples/full_frame_ip_tcp.pkt000066400000000000000000000001121335744303000223350ustar00rootroot00000000000000̻E<88(%R/PQ3dt7d !C'㰐pypcapfile-master/samples/ip.pkt000066400000000000000000000000241335744303000172750ustar00rootroot00000000000000E@@@ż/%Rpypcapfile-master/setup.py000077500000000000000000000023041335744303000162210ustar00rootroot00000000000000#!/usr/bin/env python import os from distutils.core import setup def read(fname): return open(os.path.join(os.path.dirname(__file__), fname)).read() setup( name='pypcapfile', version='0.12.1', description='Pure Python package for reading and parsing libpcap savefiles', long_description=read('README.rst'), author='Kyle Isom', author_email='coder@kyleisom.net', license='ISC', url='https://kisom.github.com/pypcapfile', scripts=['pcapfile_info'], packages=[ 'pcapfile', 'pcapfile.test', 'pcapfile.protocols', 'pcapfile.protocols.linklayer', 'pcapfile.protocols.network', 'pcapfile.protocols.transport', ], package_data={'pcapfile.test': ['test/test_data']}, data_files=[ ('share/doc/pcapfile', ['README.rst', 'AUTHORS', 'CONTRIBUTING']) ], classifiers=[ 'Programming Language :: Python', 'Programming Language :: Python :: 2', 'Programming Language :: Python :: 2.7', 'Programming Language :: Python :: 3', 'Programming Language :: Python :: 3.4', 'Programming Language :: Python :: 3.5', 'Programming Language :: Python :: 3.6', ], )