please i am trying to analyse a pcap file in python using dpkt. I am having troubles with the code that 1) counts the number of TCP flows in the pcap file 2) counts the number of UDP flows in the pcap file 3) counts the number of unique IP addresses 4) calculate the total number of packets per flow 5) calculate the average packet size per flow 6) calculate the duration of each flow. From my code above, i have not been able to achieve that.
I will appreciate it if anyone can help me with the python code for the above question. Thanks
this is what i have done so far
import dpkt
from functools import reduce
import socket
flows = {}
for ts,pkt in dpkt.pcap.Reader(open('tesst.pcap','rb')):
eth=dpkt.ethernet.Ethernet(pkt)
if eth.type==dpkt.ethernet.ETH_TYPE_IP:
ip=eth.data
if ip.p==dpkt.ip.IP_PROTO_TCP:
tcp = ip.data
src_ip = socket.inet_ntoa(ip.src)
src_port = tcp.sport
dst_ip = socket.inet_ntoa(ip.dst)
dst_port = tcp.dport
flow = sorted([(src_ip, src_port), (dst_ip, dst_port)])
flow = (flow[0], flow[1])
# uncomment below for uni-directional flow
# flow = (src_ip, src_port, dst_ip, dst_port)
flow_data = {
'byte_count': len(eth)
}
if flows.get(flow):
flows[flow].append(flow_data)
else:
flows[flow] = [flow_data]
for k in flows.keys():
print(f'Data for flow: {k}:')
bytes = reduce(lambda x, y: x+y,
map(lambda e: e['byte_count'], flows[k]))
print(f"Total Bytes: {bytes}")
please i am trying to analyse a pcap file in python using dpkt. I am having troubles with the code that 1) counts the number of TCP flows in the pcap file 2) counts the number of UDP flows in the pcap file 3) counts the number of unique IP addresses 4) calculate the total number of packets per flow 5) calculate the average packet size per flow 6) calculate the duration of each flow. From my code above, i have not been able to achieve that.
I will appreciate it if anyone can help me with the python code for the above question. Thanks
this is what i have done so far
import dpkt
from functools import reduce
import socket
flows = {}
for ts,pkt in dpkt.pcap.Reader(open('tesst.pcap','rb')):
eth=dpkt.ethernet.Ethernet(pkt)
for k in flows.keys():
print(f'Data for flow: {k}:')
bytes = reduce(lambda x, y: x+y,
map(lambda e: e['byte_count'], flows[k]))
print(f"Total Bytes: {bytes}")