Skip to content

Analyzing pcap files using dpkt with python #49

Description

@rabbitoc

please i am trying to analyse a pcap file in python using dpkt. I am having troubles with the code that 1) counts the number of TCP flows in the pcap file 2) counts the number of UDP flows in the pcap file 3) counts the number of unique IP addresses 4) calculate the total number of packets per flow 5) calculate the average packet size per flow 6) calculate the duration of each flow. From my code above, i have not been able to achieve that.
I will appreciate it if anyone can help me with the python code for the above question. Thanks

this is what i have done so far

import dpkt
from functools import reduce
import socket

flows = {}

for ts,pkt in dpkt.pcap.Reader(open('tesst.pcap','rb')):
eth=dpkt.ethernet.Ethernet(pkt)

if eth.type==dpkt.ethernet.ETH_TYPE_IP:

    ip=eth.data

    if ip.p==dpkt.ip.IP_PROTO_TCP:

        tcp = ip.data
        src_ip = socket.inet_ntoa(ip.src)
        src_port = tcp.sport
        dst_ip = socket.inet_ntoa(ip.dst)
        dst_port = tcp.dport

        flow = sorted([(src_ip, src_port), (dst_ip, dst_port)])
        flow = (flow[0], flow[1])
        # uncomment below for uni-directional flow
        # flow = (src_ip, src_port, dst_ip, dst_port)


        flow_data = {
            'byte_count': len(eth)
        }

        if flows.get(flow):
            flows[flow].append(flow_data)
        else:
            flows[flow] = [flow_data]

for k in flows.keys():
print(f'Data for flow: {k}:')
bytes = reduce(lambda x, y: x+y,
map(lambda e: e['byte_count'], flows[k]))
print(f"Total Bytes: {bytes}")

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions