|
|
|
conn_from_flowtuple(ft)
Convert the flow tuple into a dictionary (suitable for JSON) |
source code
|
|
|
batch_sort(input_iterator,
output_path,
buffer_size=32000,
output_class=None)
batch sort helper with temporary files, supports sorting large stuff |
source code
|
|
|
sort_pcap(inpath,
outpath)
Use SortCap class together with batch_sort to sort a pcap |
source code
|
|
|
flowtuple_from_raw(raw,
linktype=1)
Parse a packet from a pcap just enough to gain a flow description
tuple |
source code
|
|
|
payload_from_raw(raw,
linktype=1)
Get the payload from a packet, the data below TCP/UDP basically |
source code
|
|
|
next_connection_packets(piter,
linktype=1)
Extract all packets belonging to the same flow from a pcap packet
iterator. |
source code
|
|
|
packets_for_stream(fobj,
offset)
Open a PCAP, seek to a packet offset, then get all packets belonging
to the same connection. |
source code
|
|