Package modules :: Package processing :: Module network
[hide private]
[frames] | no frames]

Module network

source code

Classes [hide private]
  Pcap
Reads network data from PCAP file.
  Pcap2
Interprets the PCAP file through the httpreplay library which parses the various protocols, decrypts and decodes them, and then provides us with the high level representation of it.
  NetworkAnalysis
Network analysis.
  SortCap
SortCap is a wrapper around the packet lib (dpkt) that allows us to sort pcaps together with the batch_sort function above.
Functions [hide private]
 
iplayer_from_raw(raw, linktype=1)
Converts a raw packet to a dpkt packet regarding of link type.
source code
 
conn_from_flowtuple(ft)
Convert the flow tuple into a dictionary (suitable for JSON)
source code
 
batch_sort(input_iterator, output_path, buffer_size=32000, output_class=None)
batch sort helper with temporary files, supports sorting large stuff
source code
 
sort_pcap(inpath, outpath)
Use SortCap class together with batch_sort to sort a pcap
source code
 
flowtuple_from_raw(raw, linktype=1)
Parse a packet from a pcap just enough to gain a flow description tuple
source code
 
payload_from_raw(raw, linktype=1)
Get the payload from a packet, the data below TCP/UDP basically
source code
 
next_connection_packets(piter, linktype=1)
Extract all packets belonging to the same flow from a pcap packet iterator.
source code
 
packets_for_stream(fobj, offset)
Open a PCAP, seek to a packet offset, then get all packets belonging to the same connection.
source code
Variables [hide private]
  HAVE_DPKT = False
  HAVE_HTTPREPLAY = False
  Keyed = namedtuple("Keyed", ["key", "obj"])
  Packet = namedtuple("Packet", ["raw", "ts"])
  log = logging.getLogger(__name__)
  cfg = Config()
  _v = getattr(httpreplay, "__version__", None) if HAVE_HTTPREPL...
Function Details [hide private]

iplayer_from_raw(raw, linktype=1)

source code 

Converts a raw packet to a dpkt packet regarding of link type.

Parameters:
  • raw - raw packet
  • linktype - integer describing link type as expected by dpkt

Variables Details [hide private]

_v

Value:
getattr(httpreplay, "__version__", None) if HAVE_HTTPREPLAY else None