清理原因
深度学习模型由于需要清理pcap的ip地址、mac地址和端口号进行训练,防止过拟合,如果在识别的过程中,测试数据不进行同样的清理,会影响模型的识别效果,使得相比训练时效果差很多。
一、利用gopacker进行抓包
package main
import (
"fmt"
"github.com/google/gopacket"
"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
"log"
"time"
)
var (
device string = "\\Device\\NPF_{B6EC5305-3B8D-4EEC-AE49-3A871F097FD4}"
snapshotLen int32 = 1024
promiscuous bool = false
err error
timeout time.Duration = 30 * time.Second
handle *pcap.Handle
)
func main() {
// Open device
handle, err = pcap.OpenLive(device, snapshotLen, promiscuous, timeout)
if err != nil {log.Fatal(err) }
defer handle.Close()
packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
for packet := range packetSource.Packets() {
fmt.Println("oldpacket:",packet.Data())
fmt.Println(packet.Metadata().CaptureInfo)
printPacketInfo(packet)
fmt.Println("newpacket:",packet.Data())
fmt.Println(packet.Metadata().CaptureInfo)
}
}
二、对pcap每层进行清理
func printPacketInfo(packet gopacket.Packet) {
// Let's see if the packet is an ethernet packet
// 判断数据包是否为以太网数据包,可解析出源mac地址、目的mac地址、以太网类型(如ip类型)等
ethernetLayer := packet.Layer(layers.LayerTypeEthernet)
if ethernetLayer != nil {
fmt.Println("Ethernet layer detected.")
ethernetPacket, _ := ethernetLayer.(*layers.Ethernet)
fmt.Println("Source MAC: ", ethernetPacket.SrcMAC)
fmt.Println("Destination MAC: ", ethernetPacket.DstMAC)
ethernetPacket.SrcMAC[0] = 0
ethernetPacket.SrcMAC[1] = 0
ethernetPacket.SrcMAC[2] = 0
ethernetPacket.SrcMAC[3] = 0
ethernetPacket.SrcMAC[4] = 0
ethernetPacket.SrcMAC[5] = 0
ethernetPacket.DstMAC[0] = 0
ethernetPacket.DstMAC[1] = 0
ethernetPacket.DstMAC[2] = 0
ethernetPacket.DstMAC[3] = 0
ethernetPacket.DstMAC[4] = 0
ethernetPacket.DstMAC[5] = 0
fmt.Println("Source MAC: ", ethernetPacket.SrcMAC)
fmt.Println("Destination MAC: ", ethernetPacket.DstMAC)
// Ethernet type is typically IPv4 but could be ARP or other
fmt.Println("Ethernet type: ", ethernetPacket.EthernetType)
fmt.Println()
}
// Let's see if the packet is IP (even though the ether type told us)
// 判断数据包是否为IP数据包,可解析出源ip、目的ip、协议号等
ipLayer := packet.Layer(layers.LayerTypeIPv4)
if ipLayer != nil {
fmt.Println("IPv4 layer detected.")
ip, _ := ipLayer.(*layers.IPv4)
// IP layer variables:
// Version (Either 4 or 6)
// IHL (IP Header Length in 32-bit words)
// TOS, Length, Id, Flags, FragOffset, TTL, Protocol (TCP?),
// Checksum, SrcIP, DstIP
fmt.Printf("From %s to %s\n", ip.SrcIP, ip.DstIP)
ip.SrcIP[0] = 0
ip.SrcIP[1] = 0
ip.SrcIP[2] = 0
ip.SrcIP[3] = 0
ip.DstIP[0] = 0
ip.DstIP[1] = 0
ip.DstIP[2] = 0
ip.DstIP[3] = 0
fmt.Printf("From %s to %s\n", ip.SrcIP, ip.DstIP)
fmt.Println("Protocol: ", ip.Protocol)
fmt.Println()
}
// Let's see if the packet is TCP
// 判断数据包是否为TCP数据包,可解析源端口、目的端口、seq序列号、tcp标志位等
tcpLayer := packet.Layer(layers.LayerTypeTCP)
if tcpLayer != nil {
fmt.Println("TCP layer detected.")
tcp, _ := tcpLayer.(*layers.TCP)
// TCP layer variables:
// SrcPort, DstPort, Seq, Ack, DataOffset, Window, Checksum, Urgent
// Bool flags: FIN, SYN, RST, PSH, ACK, URG, ECE, CWR, NS
fmt.Printf("From port %d to %d\n", tcp.SrcPort, tcp.DstPort)
tcp.SrcPort = 0
tcp.DstPort = 0
fmt.Printf("From port %d to %d\n", tcp.SrcPort, tcp.DstPort)
fmt.Println("Sequence number: ", tcp.Seq)
fmt.Println()
}
// Iterate over all layers, printing out each layer type
fmt.Println("All packet layers:")
for _, layer := range packet.Layers() {
fmt.Println("- ", layer.LayerType())
}
///.......................................................
// Check for errors
// 判断layer是否存在错误
if err := packet.ErrorLayer(); err != nil {
fmt.Println("Error decoding some part of the packet:", err)
}
}