python解析pcap提取{src ip,src port,protocol,dst ip, dst port}五元组,再提取网络流(包括前向流与后向流)

python 同时被 2 个专栏收录
292 篇文章 0 订阅
21 篇文章 0 订阅

通过解析pcap文件,按照{src ip, src port, transport protocol , dst ip, dst port} 拆分流,并提取出前向流(Forward)与后向流(Backward),代码如下:

import pyshark
import pandas as pd


class Net_flow(object):
    def __init__(self, file_path):
        self.cap = pyshark.FileCapture(file_path)

    # {ip_server, ip_client,transport ,port_server, port_client}
    def get_target_client_ip_port(self, num=None):
        for index, pkt in enumerate(self.cap):
            ip_server = pkt.ip.src
            port_server = pkt.tcp.srcport
            # protocol_number = pkt.ip.proto  #有时要提前协议号,就是这行代码 icmp 1, igmp 2, tcp 6, udp 17
            ip_client = pkt.ip.dst
            port_client = pkt.tcp.dstport
            timestamp = pkt.sniff_timestamp
            transport_layer = pkt.transport_layer
            length = pkt.length
            if num:# 如果指定num=100,则只会输出100个流
                if index > num:
                    return [ip_server + ":" + port_server, ip_client + ":" + port_client, transport_layer, timestamp, length]
            yield [ip_server + ":" + port_server, ip_client + ":" + port_client, transport_layer, timestamp,length]

if __name__ == '__main__':
    try:
        pcap_file = "pacp文件地址"
        net_flow = Net_flow(pcap_file)
        target_client_ip_port = net_flow.get_target_client_ip_port()
        with open("保存的文件.csv", 'a') as f:# 将提取出的五元组保存起来
            for target_client_ip_port_temp in target_client_ip_port:
                write_str = ",".join(target_client_ip_port_temp)
                f.write(write_str + "\r\n")
    except Exception as e:
        print(e)

上面的代码提取出了五元组,将它们保存起来或是直接放在内存中,然后就可以根据这个提取网络流了,这里包括前向流(forward)与后向流(backward):

import pandas as pd

def get_features(file_name):
    finish_flow_list = []
    dataframe = pd.read_csv(file_name, header=None)
    dataframe.columns = ['addr_ip', 'dst_ip', 'protocol', 'timestamp', 'length']
    # 思路是通过value_counts将大的dataframe拆分成小的dataframe
    addr_diff = dataframe['addr_ip'].value_counts().index
    for addr_ip in addr_diff:
        addr_df = dataframe[dataframe['addr_ip'] == addr_ip]
        diff_dst_index = addr_df['dst_ip'].value_counts().index
        for dst_ip in diff_dst_index:
            # 定义addr_ip->dst_ip为forward
            forward_se = dataframe.loc[dataframe['addr_ip'] == addr_ip, 'dst_ip'] == dst_ip # 这是通过两列数据定位dataframe
            forward_df = dataframe.loc[forward_se[forward_se == True].index]
            forward_df['state'] = 'forward'
            backward_se = dataframe.loc[dataframe['addr_ip'] == dst_ip, 'dst_ip'] == addr_ip
            backward_df = dataframe.loc[backward_se[backward_se == True].index]
            backward_df['state'] = 'backward'
            yield pd.concat([forward_df, backward_df])

def analyze_flow(dataframe):
    forward_df_all = dataframe[dataframe['state'] == 'forward']
    backward_df_all = dataframe[dataframe['state'] == 'backward']
    # 对前向流与后向流的操作
    pass


if __name__ == '__main__':
    try:
        flow_df = get_features("五元组.csv")
        for df in flow_df:
            analyze_flow(df)
    except Exception as e:
        print(e)
  • 1
    点赞
  • 0
    评论
  • 6
    收藏
  • 一键三连
    一键三连
  • 扫一扫,分享海报

©️2021 CSDN 皮肤主题: 书香水墨 设计师:CSDN官方博客 返回首页
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、C币套餐、付费专栏及课程。

余额充值